AeroSafety World, June 2008 · if you have an article proposal, manuscript or technical paper that you believe would make a useful contribution to the ongoing dialogue about aviation

JUne 2008The Journal of flighT SafeTy foundaTion

AeroSafetyw o r l d

CRYSTAL DANGERHIGH ALTITUDE ICE SHUTS DOWN ENGINES

DELAYED RESPONSE When pilots ignore warnings

MODE AWARENESS fighting automation confusion

ADAMAIR 737 ACCIDENT loss of control from cruise

DEHYDRATION insidious performance degradation

What can you do to improve aviation safety?Join Flight Safety Foundation.Your organization on the FSF membership list and Internet site presents your commitment to safety to the world.

An independent, industry-supported, nonprofit organization for the

exchange of safety information for more than 50 years

If your organization is interested in joining Flight Safety Foundation, we will be pleased to send you a free membership kit.

Send your request to: Flight Safety Foundation 601 Madison Street, Suite 300, Alexandria, VA 22314 USA

Telephone: +1 703.739.6700; Fax: +1 703.739.6708 E-mail: [email protected]

Visit our Internet site at www.flightsafety.org

• Receive AeroSafety World, a new magazine developed from decades of award-winning publications.

• Receive discounts to attend well-established safety seminars for airline and corporate aviation managers.

• Receive member-only mailings of special reports on important safety issues such as controlled flight into terrain (CFIT), approach-and-landing accidents, human factors, and fatigue countermeasures.

• Receive discounts on Safety Services including operational safety audits.

Wri

ght F

lyer

pho

to/s

ourc

e: U

.S. N

atio

nal A

eron

autic

s an

d Sp

ace

Adm

inis

tratio

n

| 1www.flightsafety.org | AeroSAfetyworld | June 2008

President’sMeSSAge

it has been a rough couple of months for safety man-agement in the United States, as discussed in this AeroSafety World and in last month’s edition.

The basic problem is that the underlying con-cepts of safety management — voluntary reporting, risk management and collaboration — have been largely dismissed by politicians and the general news media as weak and ineffective safety regulation. They like things simple; for them good enforcement equals safety. That is a notion that can be sold in a short sound bite and sends the type of “get tough” message that will win votes. Of course, that is also the type of thinking that will set aviation safety back 20 years.

This setback was not much of a surprise. Only last year a very similar chain of events played out in Canada, as one of the world leaders of safety management was effectively put on trial in front of his Parliament for advocating “lax oversight” and “industry self-regulation.” He was being pushed by Canadian labor organizations and politicians to put more inspectors on the ramp to ensure safety exclusively through enforcement. And while it seemed as though common sense would prevail and safety management would survive, a recent report has emerged to pose a new threat.

This is a difficult situation. Many of us have dedicated our lives to the protection of public safety, but the public doesn’t see it that way. The intellectual founders of safety management have left us with a powerful tool set and a language to describe it that is terribly flawed. Politicians and the press do not react to realities; they respond to words and initial perceptions. The words we have used to discuss safety management within the aviation community are not the words that will sell safety management to the public.

Let me give you some examples. Safety profes-sionals celebrate the free flow of safety information

between regulators and industry. Critics see that as “collusion.” We celebrate voluntary reporting systems, but critics visualize tainted regulators handing out free passes to industry friends. We speak of “just culture,” but what is perceived is a system that advocates immunity from prosecution and a lack of accountability. The level of integrity and responsibility that pervades the aviation safety culture, we must admit, is rare in this fractious world, and is difficult to communicate.

Maybe it is time that the public hears about the tough realities of safety management in different terms. First of all, safety management is all about accountability. If an airline fails to uphold safety, the consequences reach the highest levels. There is nowhere to hide. Voluntary reporting systems are not an easy way out. When an airline admits a mistake, they have to submit to regulatory scrutiny as they fix the mistake and the underlying system that let the mistake happen. If an airline is caught trying to hide something, enforcement action is swift. In reality, voluntary reporting systems could easily be called compulsory disclosure and improvement systems.

Perhaps most importantly, the public has to understand that under safety management, airlines can still be grounded or run out of business. If an airline can’t keep up with the program, surveillance steps up until either the risks are resolved or the airline is gone. In safety management, industry and regulators may work together, but that doesn’t mean they are not working in the public interest.

William R. Voss President and CEO

Flight Safety Foundation

wordstougher

2 | flight safety foundation | AeroSAfetyWorld | June 2008

17

features12 Coverstory | Ice Crystal Icing

17 Strategicissues | Helping Hand

22 Airportops | Feathers in the Fan

27 seminarsCASS | SMS Aspects at CASS

30 flighttech | Autoflight Audit

36 Causalfactors | Off-Course Confusion

41 flighttraining | Training for the Pilot Shortage

44 aviationMedicine | Dry and High

departments1 President’sMessage | Tougher Words

5 editorialPage | Chickens Come Home

6 airMail | Letters From Our Readers

7 safetyCalendar | Industry Events

8 inBrief | Safety News

AeroSafetyWorld

12

22

contents June2008 Vol 3 issue 6

AeroSafetyWorldtelephone: +1 703.739.6700

William r. Voss, publisher, FSF president and CEO [email protected], ext. 108

J.A. Donoghue, editor-in-chief, FSF director of publications [email protected], ext. 116

Mark Lacagnina, senior editor [email protected], ext. 114

Wayne rosenkrans, senior editor [email protected], ext. 115

Linda Werfelman, senior editor [email protected], ext. 122

rick Darby, associate editor [email protected], ext. 113

Karen K. ehrlich, web and print production coordinator [email protected], ext. 117

Ann L. Mullikin, art director and designer [email protected], ext. 120

Susan D. reed, production specialist [email protected], ext. 123

Patricia Setze, librarian [email protected], ext. 103

Editorial Advisory BoardDavid North, EAB chairman, consultant

William r. Voss, president and CEO Flight Safety Foundation

J.A. Donoghue, EAB executive secretary Flight Safety Foundation

J. randolph Babbitt, president and CEO Eclat Consulting

Steven J. Brown, senior vice president–operations National Business Aviation Association

Barry eccleston, president and CEO Airbus North America

Don Phillips, freelance transportation reporter

russell B. rayman, M.D., executive director Aerospace Medical Association

WWW.flightsafety.org | AeroSAfetyWorld | June 2008 | 3

11 foundationfocus | Recognition for Corporate Aviation Safety

48 Datalink | A Favorable Trend Continues

52 Infoscan | Maintenance Human Factors on DVD

57 onrecord | Silent Squawker

We Encourage Reprints (for permissions, go to <www.flightsafety.org/asw_home.html>)

Share Your Knowledgeif you have an article proposal, manuscript or technical paper that you believe would make a useful contribution to the ongoing dialogue about aviation safety, we will be glad to consider it. send it to director of Publications J.a. donoghue, 601 Madison st., suite 300, alexandria, Va 22314-1756 usa or [email protected].

the publications staff reserves the right to edit all submissions for publication. Copyright must be transferred to the foundation for a contribution to be published, and payment is made to the author upon publication.

Sales ContactsEurope, Central USA, Latin America Joan daly, [email protected], tel. +1.703.983.5907

Northeast USA and Canada tony Calamaro, [email protected], tel. +1.610.449.3490

Subscriptions: subscribe to AeroSafety World and become an individual member of flight safety foundation. one year subscription for 12 issues includes postage and handling — us$350. special introductory rate — $280. single issues are available for $30 for members, $45 for nonmembers. for more information, please contact the membership department, flight safety foundation, 601 Madison st., suite 300, alexandria, Va 22314-1756 usa, +1 703.739.6700 or [email protected].

AeroSafety World © Copyright 2008 by flight safety foundation inc. all rights reserved. issn 1934-4015 (print)/ issn 1937-0830 (digital). Published 12 times a year. suggestions and opinions expressed in AeroSafety World are not necessarily endorsed by flight safety foundation. nothing in these pages is intended to supersede operators’ or manufacturers’ policies, practices or requirements, or to supersede government regulations.

44

About the Coverice crystals present previously unsuspected threat.Composite: © helmut Bierbaum/airliners.net, James Macallister/istockphoto and galyna andrushko/dreamstime

30

36

Asia Pacific, Western USA Pat Walker, [email protected], tel. +1.415.387.7593

Regional Advertising Manager arlene Braithwaite, [email protected], tel. +1.410.772.0820

4 | flight safety foundation | AeroSAfetyWorld | june 2008

MemberGuideflight safety foundation 601 Madison st., suite 300, alexandria, Va, 22314-1756 usa tel: +1 703.739.6700 fax: +1 703.739.6708

www.flightsafety.org

Member enrollment ext. 105 Ann Hill, director, membership and development [email protected]

Seminar registration ext. 101 Namratha Apparao, membership services coordinator [email protected]

Seminar sponsorships ext. 105 Ann Hill, director, membership and development [email protected]

Exhibitor opportunities ext. 105 Ann Hill, director, membership and development [email protected]

FSF awards programs ext. 105 Ann Hill, director, membership and development [email protected]

Technical product orders ext. 101 Namratha Apparao, membership services coordinator [email protected]

Library services/seminar proceedings ext. 103 Patricia Setze, librarian [email protected]

Web Site ext. 117 Karen ehrlich, web and print production coordinator [email protected]

OFFicErS and STaFF

Chairman, Board of Governors Amb. Edward W. Stimpson

President and CEO William R. Voss

Executive Vice President Robert H. Vandel

General Counsel and Secretary Kenneth P. Quinn, Esq.

Treasurer David J. Barger

adMiniSTraTivE

Manager, Support Services Linda Crowley Horger

FinanciaL

Chief Financial Officer Penny Young

Accountant Feda Jamous

MEMbErShip

Director, Membership and Development Ann Hill

Membership Services Coordinator Namratha Apparao

Membership Services Coordinator Ahlam Wahdan

cOMMunicaTiOnS

Director of Communications Emily McGee

TEchnicaL

Director of Technical Programs James M. Burin

Technical Programs Specialist Norma Fields

Technical Specialist/ Safety Auditor Robert Feeler

Manager of Aviation Safety Audits Darol V. Holsman

Past President Stuart Matthews

Founder Jerome Lederer 1902–2004

SINCE 1947

flight Safety Foundation is an international membership organization dedicated to the continuous improvement of aviation safety. Nonprofit and independent, the Foundation was launched officially in 1947 in response to the aviation industry’s need

for a neutral clearinghouse to disseminate objective safety information, and for a credible and knowledgeable body that would identify threats to safety, analyze the problems and recommend practical solutions to them. Since its beginning, the Foundation has acted in the public interest to produce positive influence on aviation safety. Today, the Foundation provides leadership to more than 1,170 individuals and member organizations in 142 countries.

serving aviation safety interests for More than 60 years


editoriAlpage

the art of customer service has many elements that are common through myriad businesses. The thread I’m thinking of involves the assumed

connections passengers make between completely different parts of the airline experience. What this has to do with safety involves perception only, but it may explain some recent events.

Consider this: Driving up to a restau-rant with dingy, smeared windows, you might make an unconscious assumption that the kitchen is dirty, too, possibly unhealthful.

Similarly, it was observed some years back at an airline management conference that if passengers in the cabin see worn upholstery and a dirty service tray, they are likely to extrapolate that information into an assumption that something — say, engine maintenance — is amiss elsewhere on the aircraft.

A similar mechanism may have been at work when a furor erupted in the United States over what appeared to be the mistakes of one or a few regulators. Despite the fact that airline aviation has been undeniably safe, the U.S. Congress became outraged and consumer interest groups expressed fear. In response, the Federal Aviation Administration (FAA) reacted. For some as-yet unexplained

reason, thousands of flights were can-celed to perform an airworthiness direc-tive that seems to have been around for a while and, the mechanics said, had been changed several times.

My contention is that recent airline service behavior was a root cause of some of the outrage that morphed into fear, creating the conditions that caused the cancellations and huge financial losses. In short, this was a case, as we said in the Shenandoah Valley, of the chickens coming home to roost.

The U.S. airline industry has not been winning many friends for the past decade or so. Repeated staff and budget cuts have pared most airlines to the bone in a frantic effort to survive a brutal market. The result is a system so thin and fragile that any dis-ruption becomes a major inconvenience. One flight canceled for weather, mechani-cal or crew time reasons sends hundreds of people searching for replacement seats that generally don’t exist because there are no more backup aircraft and system load factors are at record levels and con-tinue to climb, so there’s no room on later flights. And a major weather disruption causes people to be trapped on airplanes as airlines lack the staff or resources to get them off. Passengers got steamed, and transferred their heat to the government.

In the final analysis, it doesn’t matter which airlines have poor service; all got tarred by the same brush.

I propose that this increasing tide of consumer anger over shoddy treatment made the short jump to fear when the FAA lapses were uncovered, using the same logic that says the engines are in poor shape if the tray is dirty. And politi-cians, knowing the depth of resentment against airlines, hitched their wagons to this overwhelming negative feeling to gain pre-election publicity.

It’s instructive that some of the same people in government who were push-ing FAA to clamp down on the airlines quickly became equally outraged at the amount of passenger inconvenience the groundings produced, taking the ground-ings as more proof that the agency has not been doing its job.

So what this may mean is that in order to contain fear, airlines need to do more than just be safe; they might have to keep passengers moderately happy, too.

J.A. Donoghue Editor-in-Chief

AeroSafety World

homeChiCkens Come

AeroSafety World encourages

comments from readers, and will

assume that letters and e-mails

are meant for publication unless

otherwise stated. Correspondence

is subject to editing for length

and clarity.

Write to J.A. Donoghue, director

of publications, Flight Safety

Foundation, 601 Madison St.,

Suite 300, Alexandria, VA

22314-1756 USA, or e-mail

<[email protected]>.

6 | flight safety foundation | AerosAfetyWorld | June 2008

AirMAil

Speaking of Standard Instrument Departures …

i totally agree on the threat analysis by Hans Houtman and Dick Van Eck (ASW, 4/08, p. 34) and am really

pleased by the spirit of the paper, which reflects a true spirit of collaboration between cockpit and controller. In the same spirit, I would like to raise a related issue.

There is no reason why the name of the standard instrument departure issued by the controller has to be dif-ferent from what the crew finds in the flight management system.

Taking off from Milan Malpensa on a Saronno 6H, on the FMS (no matter

which airplane are you flying), you will find: SRN 6H.

Quite often, and in several coun-tries, the accent of the controller results in pronouncing the name in the local way, and the pilot from the other side of the world may understand a differ-ent name and enter a different SID. The readback will not always help.

In my opinion, this is a situation that can easily lead to an error, and the solution would be easy: just let every-body call the same SID with the same (simple) name.

Capt. Giulio Fini safety Manager, alitalia express

© iS

tock

phot

o.co

mfsfseminars Exhibit and Sponsorship Opportunities Available

iassoctober 27–30, 2008a Joint Meeting of the fsf 61st annual international air safety seminar, ifa 38th international Conference, and iata

sheraton hotel and resort Waikiki, honolulu, hawaii, u.s.

eassMarch 16–18, 2009flight safety foundation and european regions airline association 21st annual european aviation safety seminarhilton Cyprus hotel, nicosia, Cyprus

http://www.flightsafety.org/asw/apr08/asw_apr08_p34-35.pdf


safetycAlendAr

Aviation safety event coming up? Tell industry leaders about it.

If you have a safety-related conference, seminar or meeting, we’ll list it. Get the information to us early — we’ll keep it on the calendar through the issue dated the month of the event. Send listings to Rick Darby at Flight Safety Foundation, 601 Madison St., Suite 300, Alexandria, VA 22314-1756 USA, or <[email protected]>.

Be sure to include a phone number and/or an e-mail address for readers to contact you about the event.

JUNE 3–5 ➤ U.S.–Europe International Aviation Safety Conference. U.S. Federal Aviation Administration and European Aviation Safety Agency. St. Petersburg, Florida, U.S. Diane Migliori, <[email protected]>, <www.faa.gov/news/conferences_events/2008_eu_us_conference>, +1 202.385.8948.

JUNE 3–5 ➤ 63rd Annual General Meeting and World Air Transport Summit. International Air Transport Association. Vancouver, British Columbia, Canada. <www.iata.org/events/agm/index.htm>, +1 514.874.0202.

JUNE 4–5 ➤ Expanding Horizons: Technology Advances in Flight Simulation. Royal Aeronautical Society. London. Verna Tang, <[email protected]>, <www.raes.org.uk/conference/PDFs/578a.pdf>, +44 (0)20 7670 4372.

JUNE 4–7 ➤ 40th European Symposium. Society of Experimental Test Pilots, Swiss Section. Lucerne, Switzerland. <[email protected]>, <www.setp.org/HTML/Symposia/european.htm>.

JUNE 8–11 ➤ Conference and Exposition. American Association of Airport Executives. New Orleans. Carrie Heiden, <[email protected]>, <www.aaae.org/products/_870_Annual_2008>, +1 703.824.0504.

JUNE 9–11 ➤ 2008 Air Charter Summit. National Air Transportation Association. Chantilly, Virginia, U.S. <www.nata.aero/events/event_detail.jsp?EVENT_ID=1561>.

JUNE 11–12 ➤ FAA Southern Region Runway Safety Summit. U.S. Federal Aviation Administration. Atlanta. Anna Cohen, <www.faa.gov/aso/RunwaySafety>, +1 404.305.5593.

JUNE 16–19 ➤ 47th Annual Convention, Trade Show and Static Display. Canadian Business Aviation Association. Toronto. Janet Maslin, <www.cbaa.ca/portal/convention>, <[email protected]>, +1 613.236.5611, ext. 225.

JUNE 23–27 ➤ 15th International Flight Inspection Symposium: Shaping Aerospace Flight Inspection for the Future. U.S. Federal Aviation Administration and Gardner Tannenbaum Group. Oklahoma City, Oklahoma, U.S. Mary Waggoner, <[email protected]>, <www.ifis2008.com>, +1 405.325.3760; 800.203.5494.

JUNE 24–26 ➤ 2008 Flightscape Users Conference. Flightscape. Ottawa. <[email protected]>, <www.flightscape.com/about/conferences.php>, +1 613.225.0070, ext. 231.

JULY 8–10 ➤ Wildlife Hazard Management Workshop. Embry-Riddle Aeronautical University. Denver. <[email protected]>, <www.erau.edu/ec/soctapd/wildlife-management.html>, 866.574.9125, +1 386.226.7694.

JULY 14–20 ➤ Farnborough International Airshow. Farnborough International. <[email protected]>, <www.farnborough.com/intro.aspx>, +44 (0)1252 532800.

AUG. 14–16 ➤ Latin American Business Aviation Conference and Exhibition (LABACE) 2008. National Business Aviation Association and ABAG–Brazilian Association of General Aviation. São Paulo, Brazil. <www.labace.com.br/ing/statics.php>.

AUG. 17–19 ➤ ALA Aeronautical Convention and Exhibition. Latin American Aeronautical Association. Miami. <[email protected]>, <www.ala-internet.com>, +1 817.284.0431.

AUG. 18–21 ➤ 10th Bird Strike Committee USA/Canada Meeting. American Association of Airport Executives and Bird Strike Committee USA/Canada. Orlando, Florida, U.S. Christy Hicks, <[email protected]>, <www.aaae.org/products/meeting_details.html?Record_id=566>.

AUG. 19–21 ➤ Wichita Aviation Technology Congress & Exhibition. SAE International. Wichita, Kansas, U.S. <[email protected]>, <www.sae.org/events/watc>, 877.606.7323, +1 724.776.4970.

SEPT. 4 ➤ De/Anti-Icing Seminar. National Air Transportation Association. Boise, Idaho, U.S. <www.nata.aero/events/event_detail.jsp?EVENT_ID=1661>.

SEPT. 10–11 ➤ Crisis Preparedness Conference and Aeropolitical Conference for Legal Issues Facing the Aviation Industry. Latin American Air Transport Association (ALTA). Miami. Valerie Garcia, <[email protected]>, <www.alta.aero/crisispreparedness>, <www.alta.aero/aviationlaw>, +1 786.522.7824.

SEPT. 15–18 ➤ Flight Simulator Engineering and Maintenance Conference. ARINC. Salt Lake City. Sam Buckwalter, <[email protected]>, <www.aviation-ia.com/fsemc>, +1 410.266.2008.

SEPT. 16 ➤ De/Anti-Icing Seminar. National Air Transportation Association. Cleveland. <www.nata.aero/events/event_detail.jsp?EVENT_ID=1701>.

SEPT. 16–19 ➤ 34th European Rotorcraft Forum. Council of European Aerospace Societies and the Royal Aeronautical Society. Liverpool, England. <[email protected]>, <www.aerosociety.com/cmspage.asp?cmsitemid=ConferenceAndEvents_ERF34>, +44 (0)20 7670 4300.

OCT. 4–5 ➤ Flight Operations Manual Workshop: Employing the International Standard for Business Aircraft Operations. National Business Aviation Association. Orlando, Florida, U.S. Sarah Dicke, <[email protected]>, <web.nbaa.org/public/cs>, +1 202.783.9000.

OCT. 6–8 ➤ 61st Annual Meeting and Convention. National Business Aviation Association. Orlando, Florida, U.S. Donna Raphael, <[email protected]>, <web.nbaa.org/public/cs/amc/2008>, +1 202.783.9000.

OCT. 9 ➤ Maintenance Manual Workshop. National Business Aviation Association. Orlando, Florida, U.S. Donna Raphael, <[email protected]>, <web.nbaa.org/public/cs>, +1 202.783.9000.

OCT. 15–18 ➤ 25th International Meeting of Aerospace Medicine. Mexican Association of Aviation Medicine and the Iberoamerican Association of Aerospace Medicine. Zacatecas, Mexico. Luis A. Amezcua González, M.D. <[email protected]>, <www.amma.org.mx>, +52 55 55.23.82.17.

OCT. 21 ➤ Accident Prevention via Human Factors Training. National Air Transportation Association. San Diego. <www.nata.aero/events/event_detail.jsp?EVENT_ID=1582>.

OCT. 27–30 ➤ International Air Safety Seminar (IASS). Flight Safety Foundation, International Federation of Airworthiness and International Air Transport Association. Honolulu. Namratha Apparao, <[email protected]>, +1 703.739.6700, ext. 101.

OCT. 27–29 ➤ 46th Annual Symposium. SAFE Association. Reno, Nevada, U.S. Jeani Benton, <[email protected]>, <www.safeassociation.com>, +1 541.895.3012.


inBrief

the European Aviation Safety Agency (EASA) plans to institute a “proactive advance audit” begin-

ning in 2009 for operators that plan to fly their aircraft into Europe.

EASA Executive Director Patrick Goudou told a meeting of the Royal Aeronautical Society that operators that fail audits will be barred from entering European airspace.

If an approved foreign operator violates international safety standards, EASA’s approval to operate in Euro-pean airspace can be withdrawn, Gou-dou said. In these cases, the operator will automatically be placed on EASA’s blacklist “until we are convinced it is safe again,” he said.

The European Union first published its blacklist in 2006 as a means of pub-licly identifying operators that do not meet international safety standards and therefore would not be permitted to land their aircraft at European airports.

Goudou said that the safety audit “guarantees the necessary technical safety assessment” of foreign operators, while the blacklist “ensures citizens are properly informed about our actions.”

EASA Plans Advance Audits

eurocontrol has conducted a large-scale real-time simulation involving three air traffic control centers to evaluate new airspace and route scenarios.

The AMRUFRA project — named for the Amsterdam, Ruhr and Frankfurt areas affected — was conducted in April. It involved 25 air traffic controllers and both civil and military operators.

The simulation was designed to examine the effects on airspace organization of the opening of a new runway at Germany’s Frankfurt Airport. The runway was expected to increase traffic not only at Frankfurt but also at Amsterdam Airport Schiphol in the Netherlands and to increase the complexity of routings and proce-dures in the area, including the Ruhr Valley in Germany, Eurocontrol said.

The simulation was intended to evaluate “not only the expected benefit of the changes in capacity and safety but also the benefits on efficiency for the airspace us-ers, as well as efficiency from the air traffic controller’s perspective,” Eurocontrol said.

ATC Simulation

flight Safety Foundation, the International Federation of Air Traffic Controllers’ Associations (IFATCA) and the International Federation of Air Line Pilots’ Associations

(IFALPA) have criticized the prosecution and conviction of two air traffic controllers on duty at the time of a near midair collision of two Japan Airlines aircraft. A Japanese court also imposed prison sentences on the two controllers but suspended the sentences.

“The prosecution and conviction of these two air traffic controllers in a situation where there was no intent of wrongdo-ing is contrary to international best practices for aviation safety and the principles of a just culture,” the three organizations said in a joint statement.

The incident, which occurred Jan. 31, 2001, over Yaizu, involved a Boeing 747 on a flight from Tokyo to Okinawa and a McDonnell Douglas DC-10 en route from Busan, South Korea, to Tokyo. Published reports said that nine people in the 747

received serious injuries when the captain pushed the airplane into a dive to avoid the DC-10; the flight crews had received conflicting instructions from air traffic control and their traffic-alert and collision avoidance systems.

Convictions Denounced

© Jim Jurica/iStockphoto.com

© Eurocontrol

safety news

| 9WWW.flightsafety.org | AeroSAfetyWorld | June 2008

inBrief

the U.S. Federal Aviation Admin-istration (FAA) is implementing a program to monitor inspections

being conducted by its field offices and to alert key FAA personnel if a safety inspection is overdue.

The program is one of several measures that Transportation Secre-tary Mary E. Peters says are intended to improve the FAA safety inspec-tion program and to minimize travel disruptions that result from airline decisions to ground aircraft. Peters also authorized an independent review team to develop recommendations by early August to improve the aviation safety system. Team members include Ambas-sador Edward W. Stimpson, chairman of the Flight Safety Foundation Board of Governors, and Hon. Carl W. Vogt, a former Board of Governors chairman. Other members are J. Randolph Babbitt, an aviation and labor consultant and a member of the ASW Editorial Advisory Board; William O. McCabe, president of an aerospace consulting firm and a member of the Foundation’s Board of Governors; and Malcolm K. Sparrow, a professor of public management at Harvard University.

Peters’ announcements followed the cancellation of about 3,000 flights by American Airlines in early April so that

the airline could conduct FAA-required inspections of aircraft wiring and an earlier report that Southwest Airlines had been permitted to operate aircraft that had not undergone required safety inspections in 2007.

Peters said that although the FAA’s handling of safety oversight has been sound and delivered “decisive results,” the circumstances surrounding the missed inspections made clear that “a good system can always be made better.” The actions that she has ordered will “help make inspectors and managers more accountable, keep airlines focused on safety and minimize disruptions for travelers,” she said.

In a related matter, a report by the Transportation Department’s inspec-tor general said that officials in the Dallas–Fort Worth Terminal Radar Approach Control (TRACON) facility had misclassified airspace errors to blame pilots for mistakes that should have been attributed to controllers. The misclassifications involved 62 air-traffic events between November 2005 and July 2007.

In response, the FAA removed the TRACON manager and assistant manager from their positions, “pending a final determination on possible further personnel actions,” and said that it would

take steps to strengthen the reporting system used to classify airspace errors.

Hank Krakowski, chief operating officer of the FAA Air Traffic Organiza-tion, said he was “deeply disturbed” by the inspector general’s findings.

“The safety of the traveling public is our top priority and will not be compro-mised,” Krakowski said. “The intentional distorting of reporting incidents defeats our ability to understand the root causes of errors and enact mitigation if we see a trend developing. Aside from the integ-rity issue, it’s a lost opportunity to gain insight into causal factors.”

The FAA will take steps to prevent similar misclassifications at other facili-ties nationwide, he said.

Improved Safety Inspections Sought

a survey of about 140 aviation professionals has found that most expect no improvement in airline safety over the next five years. The survey by Ascend, an aerospace consulting firm based in

London, found that 56 percent expect that the safety level will stay the same or worsen during the “near to medium term.” More than half of the respondents said that they are directly responsible for safety.

The industry has recorded consistent improvements in safety for more than 60 years, but respondents said that the greatest threat to safety is “a shortage of experienced personnel.” Other concerns were “fatigue/work practice” and “airline management experience/attitudes/culture.”

“Management accountability for safety” was ranked as the most important factor in improving safety, followed by “improvements in aircraft technology” and “increased sharing of safety data/analysis.”

Safety Plateau?

© Lars Lindblad/Dreamstime.com

U.S National Aeronautics and Space Administration


inBrief

Worldwide shortages of air traffic controllers have increased reliance on con-

trollers working significant amounts of overtime — a situation that is “neither safe nor sustainable,” the In-ternational Federation of Air Traffic Controllers’ Associations (IFATCA) says.

IFATCA’s conclusions were based on a survey of its member associations. Their perceptions of safety issues differed significantly from those of many air naviga-tion service providers, especially in the areas involving staffing levels.

IFATCA estimates the shortage at about 3,000 controllers and attributes the problem to several factors, including the failure of the profession to attract

new trainees, the willingness and ability of air navigation service providers to conduct sufficient training, the aging of the current work force, major new initiatives that require extra staffing by controllers, reliance on overtime to conduct “normal” operations and the rapid expansion of infrastructure caused by booming Asian economies.

Controllers See Global Staf ng Shortages

the first group of aviation safety inspectors from Indonesia has completed a training session in

Australia as part of a three-year bilat-eral assistance package. The agreement calls for the Civil Aviation Safety Au-thority of Australia to provide training for up to 40 Indonesian aviation safety inspectors each year. … Representatives of Europe’s general aviation community have held the first meeting of the Eu-ropean General Aviation Safety Team (EGAST), which was established to promote best practices and improve safety in general aviation. … The U.S. National Transportation Safety Board is proposing an amendment to its regulations to provide for the investiga-tion of accidents involving unmanned aircraft systems (ASW, 12/07, p. 42).

Correction … In the May issue, an incorrect credit appeared with the photograph of modern-day London City Airport on p. 18. The photo credit should have read: Ercan Karakas/ JetPhotos.net.

In Other News …

a collaborative initiative advanced by the International Civil Aviation Organization (ICAO) likely will ac-

celerate safety improvements in African aviation, Roberto Kobeh González, president of the ICAO Council, says.

González told a meeting of the ICAO Air Transport Symposium in Abuja, Ni-geria, that safety is an essential condition for the growth of the aviation industry in Africa. He said that he expects ICAO’s Comprehensive Regional Implementa-tion Plan for Aviation Safety in Africa (the AFI Plan) to accelerate the spread of aviation safety across the continent.

In the years before development of the AFI Plan, he said, “many well-intentioned efforts … were either too

often uncoordinated or perhaps insufficient and inappropriate. The AFI Plan corrects the trajec-tory by adopting the strategy and methodology contained in ICAO’s performance-based Global Aviation Safety Plan and the industry’s Global Aviation Safety Roadmap,” both of which “concentrate on activities with the highest return for improving safety,” González said.

Safety and the liberalization of the air transport sector are two conditions most likely to speed the growth of the air transport industry in Africa, he said.

“Air transport on the continent holds tremendous potential for growth

and economic development by foster-ing trade and foreign investments, yet at the moment it remains relatively small, compared to those of other continents. The challenge lies in bridging the gap between the realities of today and the promises of tomorrow,” Gonzalez said.

‘Bright Future’ for African Aviation

Compiled and edited by Linda Werfelman.

© The Boeing Co.

© U.S. National Air Traffic Controllers Association

http://www.flightsafety.org/asw/dec07/asw_dec07_p42-46.pdf


foundAtionfocus

at the 2008 Corporate Aviation Safety Seminar (CASS), participants heard about innovations in technology and strategy for safety in corporate avia-

tion. George Saling, who was presented with the Business Aviation Meritorious Service Award at the seminar, exemplified another aspect of the risk-reduction mission: the ini-tiative that transforms new developments into constructive action and implementation.

Saling’s career included management positions with FlightSafety International and Philip Morris (now Altria Corp.). As director of aviation, and later vice president for avia-tion and travel services at Philip Morris, Saling and his staff transformed the department into a worldwide travel support operation. Under his leadership, the Philip Morris and Altria flight department was the first to implement a corporate flight operational quality assurance (CFOQA) program, and he has been a long-standing supporter of FOQA for the industry.

At Altria, Saling stressed safety, profes-sionalism and employee development. A gen-eration of talented, safety-oriented aviation professionals was nurtured thanks to him. Altria was one of the first corporate flight de-partments to be certified to ISO [International Organization for Standardization] 9002, and subsequently to the IS-BAO [International

Standard for Business Aircraft Operations] Level III standard.

He developed a safety management system that became the National Business Aviation Association’s (NBAA’s) best practice stan-dard. Saling was instrumental in establishing NBAA’s maintenance committee and a pro-gram to measure, and improve, aircraft reli-ability and maintainability. He served on the NBAA board of directors from 1994 through 2005, and at various times he was chairman of the industry affairs, nominating and mem-bership committees. He served as treasurer, vice chairman and, from 2001 to 2003, chairman of the board.

FSF President and CEO William R. Voss, in present-ing the award, said, “It would take more time than we have available to talk about all of George Saling’s accomplishments, but one that stands out in my mind is his dedication to our C- FOQA program.” ●

Flight Safety

Foundation Chairman

Amb. Edward W.

Stimpson (left)

presents Saling

with award.

Recognition for

george saling receives the 2008 Business aviation Meritorious service award at cass.

corporate aviation safety

© Ja

mes

Mac

Allis

ter/

iSto

ckph

oto


Coverstory

Previously inexplicable high- altitude turbine engine flame-outs have been the focus of investigations that are provid-

ing a better understanding of the role played by ice crystals and how the incidents can be avoided.

Ice crystals in significant quantities can be lofted into the atmosphere by con-vective activity typical of thunderstorms, squall lines and tropical storms. The crystals do not build up on the airframe and are invisible to on-board weather radar and ice detectors. Until recently,

flight crews generally were unaware of the hazard. As a result, the more than 100 power losses that have been attributed to ice crystal icing over the past two decades have caught pilots off guard.

A report on a study of 46 power-loss events for which sufficient data were available revealed some common char-acteristics.1 Most of the events occurred in summer, in relatively warm air above 20,000 ft and near convective weather (Figure 1). Many occurred in instrument meteorological conditions (IMC) with light to moderate turbulence. Several

events occurred while pilots were deviat-ing around thunderstorms or areas of significant precipitation shown on their radar displays.

Ice crystals previously were thought to be harmless to airplanes because they would simply bounce off the airframe and engine surfaces, without accret-ing. Researchers now believe that ice crystals can partially melt, due to com-pression effects, as they pass through the engine fan section, enter the engine core and create a film of moisture on relatively warm surfaces, such as the

Ice Crystal Icing

| 13WWW.flightsafety.org | AeroSAfetyWorld | june 2008

Coverstory

| 13

forward stator vanes (Figure 2, p. 14). The mois-ture traps additional ice crystals, and, eventually, the ice buildup is shed into the compressor, caus-ing the engine to surge and stall, and possibly reaching the combustor, causing a flameout.

The report said that 28 of the power-loss events occurred during descent, 17 during cruise, and one during climb. Power typically is set at idle during descent, resulting in minimum airflow through the engines. “The engine’s ca-pability to tolerate ice particles is related to the airflow and decreases as density decreases with altitude … where ice particles can constitute a greater proportion of the total airflow in the engine,” the report said. Also, the compressor section is more susceptible to ice accretion at low power because of the reduced temperature.

The power-loss events that occurred at high power during cruise and climb likely involved extended exposure to very high concentrations of ice crystals.2

‘Rain’ on the WindshieldMany power losses initially were not thought to be related to ice crystal icing because the pilots said that their airplanes were in heavy rain when the events occurred. This perception was based on observations of rain striking the windshield. However, some pilots also said that the sound was different than rain striking the windshield and that, when the landing lights were turned on, the particles looked different from rain. Only recently have the observations

of heavy rain been linked to ice crystals that melted on heated windshields.

Another possible clue to the presence of a high concentration of ice crystals at altitude is anoma-lous total air temperature (TAT) indications, which include the increase in outside — static — air temperature due to compression. Researchers believe that erratic and erroneously warm TAT

Power-Loss Event Altitudes and Temperatures

–80

–60

–40

–20

0

20

40

10,000 20,000 30,000 40,000

Altitude (ft)

Am

bien

t tem

pera

ture

(deg

rees

C)

Power-loss eventStandard atmosphereStandard atmosphere +10 degrees CStandard atmosphere –10 degrees C

Source: Courtesy of Boeing AERO Magazine

Figure 1

© M

ark

Ross

/Dre

amst

ime

Ice Crystal Icing A nearly undetectable weather hazard can knock out a jet engine.

BY MARK LACAGNINA


Coverstory

indications are caused by ice crystals that build up on heated TAT probes and block airflow through the probes. The report said that TAT anomalies preceded 35 of the power-loss events.

In all 46 events, the engines were restarted. “Even in the rare cases where the engine was damaged, those engines were restarted and op-erated normally for the remainder of the flight,” the report said.

‘Serious Threat’“The ice crystal phenomenon has only recently been identified as a serious potential environ-mental threat to turbine engines,” said the U.S. Federal Aviation Administration (FAA) in a special airworthiness information bulletin, SAIB NE-07-01, issued in October 2006 to owners and operators of Airbus A300s and A330s, Boeing 747s and 767s, and McDonnell Douglas MD-11s.

The bulletin cited 32 incidents since the early 1990s of flameouts, including two dual flameouts, of the General Electric CF6-80C2 and -80E1 engines used on these airplanes.

“Exposure to high concentrations of ice crystals

is believed to be associ-ated with these events, which occurred at altitudes between 11,500 and 36,000 ft and were in or near convective weather systems,” the bulletin said.

The FAA recommends that pilots avoid convec-tive weather whenever possible. “Especially avoid flying over strong convec-tive systems,” the bulletin said. “If unavoidable, maintain vigilance for recognizing a potential ice crystal encounter … and the potential for adverse engine operation.”

The bulletin said that on-board weather radar, ice detectors and visual inspections of the

airframe provided no indication of the ice crys-tal encounters; however, some pilots observed erroneous TAT indications and water droplets on heated windshields at altitudes and ambient temperatures where rain is not possible.

General Electric developed new software for the engine control units (ECUs) on CF6-80C2 and -80E1 engines to increase their resistance to flameout by modifying the variable bleed valve schedule to increase ice extraction from the core flow path. Last year, the FAA issued four airwor-thiness directives (ADs) requiring installation of the new ECU software. The ADs are “interim actions due to the ongoing investigation,” the FAA said. “We may take further rule-making actions in the future based on the results of the investigation and field experience.”

Reducing the RiskFurther rule-making actions were taken in April 2008, when the FAA proposed airplane flight manual (AFM) revisions that specify new conditions in which activation of engine anti-ice

Ice Crystal Accretion Area

Intercompressor Bleed

Core air travelsdownstreamto thecombustionsection

High-Pressure Compressor

Low-Pressure Compressor

Fan

Core Inlet Stator

Supercooled liquid water accretion areas(inlet, spinner, fan and �rst stages of the core)

Potential ice crystalaccretion areas

Source: Courtesy of Boeing AERO Magazine

Figure 2


Coverstory

systems would be required during descent in 747s, 767s and MD-11s with CF6-80C2 and -80A engines.

In the notices of proposed rule making (NPRMs), the FAA said that 747s and 767s have been involved in “several in-flight flame-out events,” including four dual flameouts, and that MD-11s have been involved in six events, including two dual flameouts. All the events involved airplanes with CF6-80C2 engines, but the NPRMs include the -80A engines because they have similar compressor designs.

“Each flameout event was in or near convec-tive weather with ice crystal icing,” the NPRMs said. “This type of icing does not appear on radar due to its low reflectivity, and neither the airplane ice detector nor visual indications indi-cate the presence of icing conditions. Therefore, it is often undetected by the flight crew.”

Increased engine idle speed and bleed flow when the anti-ice system is activated reduces the risk of flameout. “Engine anti-ice also assists with relighting the engines by turning on the igniters on airplanes that are not equipped with autore-light,” the NPRMs said. “In several of the subject engine-flameout events, the engine anti-ice was already on when the engines flamed out. In each flameout event, the engines relit and continued to operate normally for the remainder of the flight.”

The AFMs for the 1,064 affected 747s and 767s currently require activation of the engine anti-ice system in airplanes without ice detectors when TAT is between 10 degrees C and minus 40 degrees C. This is not required in airplanes with ice detectors because engine anti-ice is activated automatically when ice is detected. Noting again that ice detectors cannot detect ice crystal icing, the NPRM proposes a requirement for engine anti-ice to be activated manually at all TATs below 10 degrees C.

The NPRM for the 118 affected MD-11s does not state the current requirements for activation of the engine anti-ice system, but it proposes that activation be required when TAT is 6 degrees C and below. At press time, the FAA was still accepting public comments on the proposed ADs.3

Rollback EventA different type of ice crystal icing was identi-fied by the U.S. National Transportation Safety Board (NTSB) as the cause of an uncommanded deceleration — rollback — of the engines on an MD-82 on June 4, 2002. The incident involved blockage of the engine inlet pressure probes while the airplane was cruising at Flight Level (FL) 330 (about 33,000 ft) with the autopilot and autothrottles engaged.

The difference between inlet pressure and discharge pressure — engine pressure ratio (EPR) — is used to measure and set power in the MD-82’s Pratt & Whitney JT8D-219 engines. Blockage of the inlet pressure probes resulted in erroneously high EPR measurements, which the autothrottle system responded to by retard-ing the throttles. According to NTSB, the flight crew did not notice the power reductions and the consequent increase in nose-up pitch trim and decrease in airspeed that occurred over a period of about five minutes.

When the stick shaker activated, the captain disengaged the autopilot and pushed the control column and throttles forward. The engines ini-tially did not respond, but the crew was able to restart them as the airplane descended through 17,000 ft. Originally en route from Denver to Fort Lauderdale, Florida, with 105 passengers, the crew diverted to Wichita, Kansas, and landed without further incident.

Although the MD-82 was clear of clouds when the incident occurred, it had been flown in and out of IMC for the previous 50 nm (93 km). NTSB said that the flight crew had not engaged the engine anti-ice system, as required.

Beechjet IncidentsIce crystal icing has been identified as the prob-able cause of several dual flameouts involving Raytheon Beechjet 400 series business jets powered by Pratt & Whitney Canada (PWC) JT15D-5 engines.4 In each case, the flameouts occurred after power was reduced at high alti-tude in the vicinity of convective weather.

On July 12, 2004, the pilots of a Beechjet 400A en route from Duncan, Oklahoma, to Fort Myers,

In each case,

the flameouts

occurred after

power was reduced

at high altitude

in the vicinity of

convective weather.

© T

t/D

ream

stim

e


Coverstory

Florida, felt a jolt and heard a bang after beginning a descent in IMC from FL 410 over the Gulf of Mexico. They saw that cabin pressure was decreasing and then discovered that both engines had flamed out. They donned their oxygen masks and declared an emergency, telling air traffic control (ATC) that they were con-ducting an emergency descent. The copi-lot flew the airplane and communicated with ATC while the captain attempted to restart the engines. The airplane broke out of the clouds soon after the right en-gine was restarted at 10,000 ft. The pilots diverted to Sarasota, Florida, and landed without further incident.

On Nov. 28, 2005, Beechjet pilots were not able to restart either engine after they flamed out soon after a descent from FL 380 was initiated in visual meteorological conditions (VMC) during a positioning flight from Indianapolis to Marco Island, Florida. The crew made three attempts to restart the engines. “The pilots stated that they did not make any further attempts to restart the engines because they had descended into IMC and were con-cerned about draining the battery,” said a preliminary report by NTSB, which had not completed its investigation of the incident at press time. The crew diverted to Jacksonville, Florida, and conducted a dead-stick approach and landing. “After they landed and rolled off the runway onto a taxiway, the right landing gear tire deflated,” the prelimi-nary report said.

On June 14, 2006, a Beechjet was cruising in VMC at FL 380 — about 3,000 ft over the remnants of a tropical storm — during a flight from Quonset Point, Rhode Island, to Charleston, South Carolina, when ATC issued a heading toward an upsloping cloud deck. The crew decided to activate the engine anti-ice system before entering

the clouds. The AFM required power to be reduced below 90 percent N1 — fan speed — before activating engine anti-ice. But when the throttles were retarded, both engines flamed out. The crew had activated the continuous ignition system before retarding the throttles, and both engines restarted

“on their own” as the airplane de-scended. The crew landed at Norfolk, Virginia, without further incident.

Based on the results of a study performed by PWC during the inves-tigation, NTSB determined that the probable cause of the Sarasota and Norfolk incidents was “high-altitude ice crystals that had accreted on the com-pressor vanes and were ingested into the high-pressure compressor when the pilots retarded the power levers, causing compressor surges and flameouts of both engines.” The safety board also said that a lack of training on ice crystal icing was a contributing factor.

Raytheon subsequently issued Safety Communiqué 269, which provides guidance on how ice can form inside a turbine engine. “Operators should not assume ice formation to be impossible at very low ambient temperatures (i.e., minus 30 degrees C or colder),” the com-muniqué said. Also, the FAA issued AD 2006-21-02, requiring revision of the Beechjet AFM to require activation of the engine anti-ice system during high-altitude flight in the vicinity of visible moisture and convective storm activity.

Ongoing InvestigationMuch of the current information about ice crystal icing is theoretical. Research continues to be performed by the FAA, airplane and engine manufacturers, and other organizations to define and measure the ice crystal environment, develop internal engine icing detectors, identify other engine models that are

susceptible to ice crystal icing and to improve engine design to reduce the risk of flameout and rollback.

Boeing Commercial Airplanes, a member of the government/industry team, told ASW that progress has been made in developing improved instru-mentation, test methods and facilities to measure ice particle size, concentra-tion and extent of distribution in the atmosphere, and to understand the fundamental physics of ice accretion and shedding. “Using satellite and radar images and other meteorological analysis tools, our studies are helping to define how far from the central core of convective storms the events typically occur and thereby allowing us to pro-vide better guidance for flight crews,” the company said.

Pilots who encounter this phenome-non are encouraged to report the details to their safety directors so that the infor-mation can be shared with researchers. ●

Notes

1. Mason, Jeanne G.; Strapp, J. Walter; Chow, Philip. “The Ice Particle Threat to Engines in Flight.” Paper presented at the 44th American Institute of Aeronautics and Astronautics Aerospace Sciences Meeting and Exhibit, Reno, Nevada, U.S., January 2006. Mason is a senior specialist engineer for Boeing Commercial Airplanes; Strapp is a physical scientist at Environment Canada; and Chow is senior principal engineer at Honeywell.

2. Mason, Jeanne. “Engine Power Loss in Ice Crystals Conditions.” Boeing Aero fourth quarter, 2007.

3. Docket material is available on the Inter-net at <regulations.gov>. Search for 0402 and 0403, respectively, for the 747/767 and MD-11 dockets.

4. Raytheon Aircraft was acquired in De-cember 2006 by GS Capital Partners and renamed Hawker Beechcraft. The Beechjet’s name was changed in 2003 to Hawker 400XP.


StrAtegicissues

avionics that could save lives aboard an airliner at the brink of collision with the ground or another aircraft — overriding,

at the last possible second, the inad-equate response or loss of control by the flight crew — show promise in early flight technology demonstrations. Such auto-recovery systems, however, likely will have to prove their safety value to airlines and flight crews through reliable operation on millions of flights, says Don Bateman, chief engineer, flight safety avionics, at Honeywell.

The rationale behind research on these systems, including how they would address pilot noncompliance with cockpit warnings and loss of control accidents, was the subject of Bateman’s presentation to the Flight Safety Foundation International Air Safety Seminar in October 2007 in

Seoul, Korea. He noted that it reflected only his personal views.

The motivation for this research and development also includes a number of accidents in which an aircraft system provided a warning but the flight crew hesitated too long, ignored or incorrectly responded to the warning. “We have seen long delays in which a warning goes off and nothing happens — as much as 30 seconds goes by before, maybe, one of the pilots takes action,” Bateman said. “Aircraft should ‘refuse to be destroyed,’ for example, by loss of control.”

Attempts to prevent loss of control accidents, controlled flight into terrain (CFIT), midair collisions and other catastrophic events are hindered by factors such as too many operational warnings; multiple confusing warnings; flight crew fatigue; crew distraction; intense concentration on one task or

multiple tasks with inadequate alert-ness to warnings; visual fixation outside the airplane, such as on the runway environment; lack of appropriate pilot training or lapses in training; failure to follow standard operating procedures (SOPs); spatial disorientation includ-ing somatogravic illusion — that is, the acceleration-induced false sensation of aircraft pitch-up; strong belief by a pilot that the procedures or the instruments are correct and the warning is false; misplaced confidence by a pilot that the situation will become safer without in-tervention by the crew; and weaknesses in flight instrument design, according to Bateman.

Auto-Recovery DesignProponents of auto-recovery systems ex-pect initial designs to be capable of sav-ing lives without imposing differences

© A

nton

is Pa

pant

onio

u/iS

tock

phot

o

Helping HandBy Wayne RosenkRans

Auto-recovery systems

would ‘refuse to

be destroyed’ by a

flight crew’s inaction,

delay or incorrect

response to an

imminent collision.

18 | flight safety foundation | AeroSAfetyworld | June 2008

StrAtegicissues

on the flight deck or in how the airplane is flown, except for a disable switch, a new method of crew intervention. Basic assumptions are that:

• The system would activate only when seconds remain before a collision and there has been no flight crew response to a warning, or the flight crew response has been incorrect or too late.

• Tactile feedback to the pilots and training on the auto-recovery sys-tem would prevent its activation from surprising the flight crew.

• At some future date, auto- recovery systems would not pro-vide a disable switch for override by the flight crew — assuming that trouble-free operation had been demonstrated by analysis of data from millions of flights.

• Unwanted activations of the auto-recovery system would be limited by designers to fewer than one per 1 million flights.

• The system would be compatible with real-world airline operations.

• Auto-recovery would be immune to sensor anomalies.

• This backup function would be “invisible” to the flight crew dur-ing routine flight operations.

Airframe manufacturers, including Airbus and Boeing, have been working on related research and development, Bateman said. Technological feasibil-ity and user acceptance will require an extremely low rate of false activation of auto-recovery systems. “I think the industry can do that,” he said. “We can make it activate using a terrain data-base. We also need to be compatible with real-world operations — that is the

greatest problem that engineers have with designing auto-recovery systems.”

As currently conceived, if the threat is terrain or obstacles in the flight path of the airplane, the auto-recovery sys-tem would not activate until a relatively long time after the series of warnings by a Honeywell enhanced ground- proximity warning system (EGPWS) or other terrain awareness and warning system (TAWS). “We would wait a long time after the ‘Caution, terrain’ alarm, a long time after the ‘Pull up, pull up’ alarm and, finally, we would wait at least six, seven, eight or nine seconds or even longer before the auto-recovery system does the pull-up,” Bateman said.

Auto-recovery would involve a level of system reliability yet to be achieved in other cockpit warning systems for flight crews. “Pilots ask me, ‘With auto-recovery, aren’t you taking control away from me?’” Bateman said. “My answer is, ‘No, we’re not. You should be able to fly the airplane any way you want. But just don’t do something stupid.’ As long as we have to have a disable switch, we are going to have pilots who won’t trust this system — and rightly so — but we can hardly design systems without a disable switch until after millions of hours and millions of flights.”

In the development of auto- recovery systems, typical accident/incident scenarios considered have included continued takeoff after the activation of a configuration warning horn; subtle flight crew incapacitation by hypoxia after a cabin-altitude warn-ing horn; shutdown of the incorrect en-gine after a fire warning; selection of an incorrect crossing altitude to be flown by the autopilot; crew attention focused only on entering flight management system data, distracting them from a cockpit warning; failure to under-stand the meaning of an aural warning

annunciated in English; selection of in-correct global positioning system (GPS) coordinates or faulty/weak procedure for this task; and critical delays in crew response to alerts from TAWS/EGPWS.

Honeywell researchers have conducted tests of a prototype for an auto-recovery system aboard a modi-fied Airbus A319. “We demonstrated it along the Monterey [California, U.S.] peninsula,” Bateman said. “We took three flights toward a mountain … asking the test pilot not to recover in response to the EGPWS alerts. The mountain got bigger and bigger in the windscreen. At first, when the EGPWS said ‘Pull up, pull up,’ the pilot did not want to ignore it. But the auto-recovery worked.” If the same capability had been aboard a Boeing 747 freighter that crashed in February 1989 near Kuala Lumpur, Malaysia, hardly any altitude would have been lost during a successful automated escape maneuver based on a computer re-creation of the scenario, he said.

Three Relevant AccidentsBateman’s review of the Kuala Lum-pur accident report emphasized the criticality of immediate response to a ground-proximity warning. “This accident also can be characterized as one in which the crew did not com-ply with the SOPs,” he said. “The first ground-proximity warning came on at approximately 18 seconds from impact. They were way late in their checklist, they were still talking about what radio frequencies to set in, and so on. When the warnings went off, they were still trying to get the radios set. The warn-ings went on and on. The only one who realized that something was wrong was the flight engineer. That was too late.”

An A320 accident in May 2006 — during a missed approach to Sochi


StrAtegicissues

(Russia) Airport (ASW, 10/07, p. 44) at about 0200 local time — can be characterized as a “subtle” loss of control accident, Bateman said. Among causal factors cited in the accident report were spatial disorientation, inadequate control inputs by the captain, lack of monitoring by the copilot and the failure of both pilots to respond to a TAWS warning. Several aspects of the scenario have relevance to inadequate pilot response to warnings, instrument interpretation during a cockpit warning and auto-recovery, he said. “They were not following the SOPs, and they turned the autopilot off,” Bateman noted. “The captain got a flap overspeed indication — the master warning light — and he pushed the nose over. The copilot was trying to help him with the sidestick — his own sidestick — but never took over control.”

An A320 accident near Bahrain Interna-tional Airport in August 2000 (Accident Preven-tion, 12/02) also involved a missed approach at night. “Again, they got a master warning light for flaps exceedance speed,” Bateman said. “The captain pushed the airplane over … into the water. There were about 11 seconds of pull-up warnings but no pilot response. Nothing from the copilot. Why?” Counterintuitive instrument display of flap overspeed has come into play in such scenarios, he said.

Diagrams showed the predicted performance of an auto-recovery system in re-creations of the Kuala Lumpur, Sochi and Bahrain accidents. In the Bahrain re-creation, the EGPWS ‘Sink rate, sink rate’ alarm and ‘Pull up, pull up’ alarm occurred just as during the accident flight. The auto-recovery system waited six seconds after these warnings — approximately four seconds from impact — to conduct a standard autopilot escape maneuver. “Hardly any altitude is lost do-ing that,” Bateman said. “Nobody gets hurt.”

In re-creating the Sochi scenario, research-ers allowed about 18 seconds to elapse after the “Sink rate, sink rate” alarm without a pilot response (Figure 1). “The ‘Pull up, pull up’ alarm sounded and researchers waited until five seconds from impact. Then the machine made the recovery,” Bateman said.

Loss of Control A high priority for global airline safety profes-sionals should be risk management to address loss of control, Bateman said. “Airplane designs with built-in automatic flight envelope protec-tion or flight control limiters are driving down the loss of control risk,” Bateman said. “Exam-ples are Mach limiters, pitch-trim compensators, artificial feel mechanisms, stick shakers/pushers and fly-by-wire aircraft such as those by Airbus, Boeing and others.” Auto-recovery systems would represent a logical evolutionary step.

“Loss of control remains a major risk … the number one killer in 2007, although airplane designs have really been improved through the years,” Bateman said, urging Flight Safety Foun-dation to help direct more industry attention to loss of control. “Let’s get serious about this. There is a whole variety of things we can do at reasonable cost, hopefully.”

Excessive/Unwanted WarningsBateman made a side-by-side comparison of rates of cockpit warnings including traffic-alert and collision avoidance system (TCAS II) resolution advisories (RAs), stall warnings, EGPWS alerts,

Auto-Recovery Envisioned: Airbus A320, Sochi, Russia

EGPWS “Sink rate” warning

EGPWS “Pull up”warnings

Auto-recovery system activated

2,500

2,000

1,500

1,000

500

01.0 1.2 1.4 1.6 1.8 2.0 2.2 2.4 2.6 2.8 3.0

Distance (nm)

Hei

ght (

ft)

Flight path

EGPWS = enhanced ground-proximity warning system

Note: In a computer recreation of this accident scenario, researchers found that a proposed auto-recovery system responded successfully. In reality, the aircraft descended into the Black Sea during a missed approach on May 3, 2006.

Source: Don Bateman

Figure 1

20 | flight safety foundation | AeroSAfetyworld | June 2008

StrAtegicissues

engine fire warnings, wind shear alerts, smoke alerts and takeoff configuration warnings. The data showed that RAs by an airborne collision avoidance system (ACAS), or a TCAS, occur at a rate about 400 times greater than fire warnings or EGPWS alerts. “Frequent false operational warn-ings seriously impair pilot response,” he said.

For comparison, there were eight TCAS RAs in North America and 0.8 TCAS RAs in Europe per 1,000 departures. “There are more RAs in North America than any other region; I don’t know why,” he said. “We need to methodically col-lect the data, figure out what’s going on and fix it.”

Significant variation has occurred among the rates of different types of cockpit warning per the number of large international airliner departures (Figure 2). “I added in the engine fire rate — 0.04 — as a monitor,” Bateman said. “I believe that a good rate for an airplane cockpit warning is something like 0.04, less than about one in every 40,000 or 50,000 flights.”

The industry could eliminate many of the unwanted RAs by universal adoption of auto-matic dependent surveillance–broadcast (ADS-B) “out,” which airplanes can use to broadcast

their intended flight path as entered in a flight management system. “Now we can expand auto-recovery to midair collision threats,” Bateman said. “We have ADS-B on most new Boeing and Airbus airplanes going out into the airline fleet, and on many other airplanes soon — a better system that could reduce the unwanted RAs by at least 10 times what they are today.” The result will be an expanded threat-detection envelope enabling earlier traffic warnings.

Substantial reduction of unwanted cockpit warnings is just one of many opportunities to reduce risk. “We have beautiful flight instru-ment displays, but I still think we can do more to improve them,” Bateman said. “Pilot training to recognize and address weaknesses in displays is important. Airplane upset recovery training to cope with spatial disorientation/illusions also remains critical to pilot response.”

Another risk-reduction opportunity can be the presentation of information. Among the flight instrument indications added over many years — such as the yellow speed trend arrow on the airspeed presentation of the primary flight display — instrument designers have chosen to indicate the flaps exceedance speed range using diagonal red stripes on a vertical tape that moves downward. The red stripes disappear from view during flight at relatively low airspeeds.

“In the cockpit … red means danger, don’t go there,” Bateman said. “Pilots don’t want to go near red … on a weather radar display or a terrain dis-play. I’m not a human factors engineer, but years ago that tape should have been turned around the other way so that red would come up from the bottom during a flaps overspeed, so the pilot would want to pull the nose up to fly away from red, and vice versa for low speed.”

Nevertheless, redesign of this widely adopted “barber pole” presentation of the flap overspeed tape is unlikely. “We need to rethink how we train pilots to use it and what we can do to pre-vent another accident,” Bateman said.

EGPWS RefinementsSafety initiatives since 1996 — when 3.1 un-wanted EGPWS alerts occurred per 1,000 flight

Cockpit Warning Incidence Varies Widely

10 8

TCAS RAs– NorthAmerica

TCAS RAs– Europe

Stall EGPWS

Cock

pit w

arni

ngs

(per

1,0

00 d

epar

ture

s)

Engine�re

Wind shear Smoke Takeo�con�guration

0.8

0.080.06

0.04

0.12

0.42 0.5

1

0.1

0.01

TCAS = traffic-alert and collision avoidance system II; RA = resolution advisory; EGPWS = enhanced ground-proximity warning system

Note: Numbers comprise a combination of de-identified aggregate data from 500,000 airline flights with other sources.

Source: Don Bateman

Figure 2


StrAtegicissues

legs — have been effective (Figure 3), and the effort to keep them as low as possible continues, Bateman said. “Using de-identified flight history data, EGPWS warnings have been decreased,” he said. “Methodical collection and examination of data concerning warnings is key, and cooperation from the pilots and controllers is very important. Ten years ago, there were 1.17 hard pull-up warn-ings or terrain warnings per 1,000 flight legs, and in 2003 we got it down to 0.03 — that’s more than a 100-fold improvement in less than 10 years.”

Despite the importance of actual flight data to avionics manufacturers, such data often seem to designers to have fallen into an inaccessible “black hole” because of restricted usage, he said. Yet flight operational quality assurance (FOQA) programs at airlines, also known as flight data monitoring programs, could help designers to improve hardware/software performance. “May-be the airline knows about an event and some of the pilots know what’s going on, but flight data typically are not shared outside the airlines. The designers of equipment need to know what the unwanted-warning rates are and also the pilot response time for the event. If pilots take 15 sec-onds or longer, for example, something’s wrong.”

Ideally, designers would have access to de-identified aggregate data containing all relevant flight parameters for 20 seconds prior to a cockpit warning and the same parameters for the 10 seconds immediately afterward. Some flight parameters of special interest are the accelera-tions induced by a pilot’s control inputs within this time frame, pilot response time (Figure 4) and where the recovery occurred. For example, at distances of 35 to 45 nm (65 to 83 km) from an arrival/departure airport, pilots induced more than + 0.3 g to more than + 0.8 g (i.e., 0.3 to 0.8 times standard gravitational acceleration). “When pilots are close to the airport, pulling a quarter of a g is rather routine” during an escape maneuver, Bateman said. By comparison, the autopilot of an Airbus airplane will induce acceleration of + 0.3 g or + 0.5 g in response to TCAS RAs.

The traveling public today would not toler-ate the thousands of fatalities that occurred for decades in 19th-century steamboat accidents in

the United States, he said. Contemporary pas-sengers likewise expect the airline industry to implement the best solutions available to reduce the current rate of loss of control accidents and the risks of unheeded warnings by flight crews. ●

Fewer Unwanted EGPWS Warnings in Global Air Transport

19960.0

3.5

3.0

2.5

2.0

1.5

1.0

0.5

1998 2000 2003

3.10

1.17

0.69

0.03*Co

ckpi

t war

ning

s (p

er 1

,000

�ig

ht le

gs)

Year


* Data for 2003 assumed that the latest EGPWS software (–218) and database (–435) were installed and the aircraft had global positioning system navigation.

Source: Don Bateman

Figure 3

Pilot Responses to EGPWS Look-Ahead Alerts

0

5

10

15

20

25

30

35

40

45

50

0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 >15

Ale

rts

obse

rved

Response time (seconds)


Note: Look-ahead alerts comprise cautions and warnings.

Source: Don Bateman

Figure 4


AirportoPs

data show that almost all bird strike– related hull losses of turbofan and turbojet transport aircraft worldwide occur during the departure phase of

flight, when the risk of substantial engine dam-age is at least five times more likely than during arrival.

Analysis of the 24 bird strike–induced hull losses of turbofan and turbojet transport aircraft that were reported worldwide from 1968 to 20051 showed that all but one occurred dur-ing the departure phase and that at least 20 of the accidents involved ingestion of birds into aircraft engines (Table 1, p. 24). Analysis of U.S. strikes reported from 1990–2006 also showed increased risks of substantial damage during departure. These findings demonstrate the need for airports to act to minimize risks of serious bird strikes and for pilots to cooperate with airport bird strike–attenuation efforts.

The study of the 24 hull loss accidents — involving 18 turbofan aircraft and six turbojets — found that 17 of the 18 turbofan accidents and all six turbojet accidents occurred during departure, when the aircraft was no higher than 100 ft above ground level (AGL).

Birds were ingested into one or more engines in at least 14 of the 17 hull loss accidents that occurred during departure; in two other acci-dents, reports did not identify which part of the aircraft was struck, but engine ingestions were likely. In all six turbojet accidents, ingestion of birds into an engine was likely.

Turbofan AnalysisA separate analysis of the 40,286 bird strikes reported in turbofan civil aircraft in the United States from 1990–2006 found that 38,437, or 95 percent, occurred during either departure or arrival (Table 2, p. 24).2 Of the strikes that occurred while the aircraft was on the ground, the number reported during the takeoff roll was 1.2 times higher than the number reported during the landing roll. However, engine ingestion was 2.3 times more likely during the takeoff roll, and substantial engine damage was 7.7 times more likely.

During the climb component of departure, 7,382 bird strikes were reported — less than half as many as the 16,408 reported during the approach component of arrival. However, the number of ingestions into an engine was similar, and substan-tial engine damage was reported 2.2 times more frequently during departure than during arrival.

Overall, 15,377 reported strikes were docu-mented for the departure phase — including the takeoff roll and initial climb — about two-thirds as many as the 23,060 reported during the arriv-al phase — including the approach and the land-ing roll. However, data showed that birds struck by aircraft were more than two times as likely to be ingested into engines during departure than during arrival — 12.6 percent of departure bird strikes resulted in engine ingestion, compared with 5.7 percent of arrival bird strikes.

Data also showed that 3.4 times more bird strikes resulted in substantial engine damage during departure (916 strikes) than during arrival (270 strikes) and that a departure bird strike was about five times more likely than an arrival bird strike to result in substantial engine damage.

For turbofan civil aircraft in the United States from 1990–2006, only one of the 916 bird strikes reported to have caused substantial engine damage on departure actually resulted in a hull loss. At least 41 of the 916 strikes, including the hull loss, involved ingestion of birds into two engines, and damage to those engines; 13 of the 270 bird strikes reported to have caused substantial engine damage during arrival resulted in damage to two engines.

Turbojet DifferencesFor turbojet aircraft, differences were more pronounced in the extent of damage associated with the arrival and departure bird strikes. Of the 328 strikes reported in turbojet aircraft, 313, or 95 percent, occurred during either departure or arrival. They were almost evenly divided between the two categories; 155 occurred during departure and 159 during arrival. However, bird strikes during departure were 3.7 times more likely to involve engine ingestion and 5.8 times more likely to cause substantial engine damage than bird strikes during arrival. ©

Q. T

seng

/Airl

iner

s.net

Chances of

substantial

engine damage

from a bird strike

are far greater

during departure

than any other

phase of flight.


AirportoPs

in the Fan

© T

iero

/Dre

amst

ime.

com

FeathersBY RICHARD A. DOLBEER


AirportoPs

Only one of the 29 departure bird strikes — and none of the arrival bird strikes — that were reported to have caused substantial damage resulted in a hull loss. At least three of the de-parture strikes, including the hull loss, involved ingestion of birds into two engines and dam-age to the engines. Damage to two engines was reported in one of the five arrival strikes that involved substantial engine damage.

Synergistic FactorsThe primary reason that bird strikes are more likely during arrival than departure is that aircraft

typically spend more time below 3,500 ft AGL during the arrival phase of flight. Previ-ous studies have found that 95 percent of bird strikes occur below 3,500 ft AGL.3

However, although some studies have produced conflicting findings,4,5 birds ap-pear to be more likely to be ingested into aircraft engines during strikes that occur on departure.

Three synergistic factors may explain why bird strikes are most likely to have serious consequences when they occur during the departure phase.

First, fan and compressor rotor speeds are higher during departure, a factor that may increase the possibility that birds near an engine will be ingested. Second, the increase in kinetic energy of fan blades and compressor blades during depar-ture increases the likelihood of substantial damage after bird ingestion. And third, flight crews typi-cally face more challenges — and must make more decisions — in dealing with failed or compromised engines during departure than during approach.

U.S. Bird Strikes Involving Turbofan Civil Aircraft, 1990-2006

Phase of FlightTotal Reported

Strikes

Strikes With Bird Ingested Into Engine

Percent of All Strikes

With Engine Ingestion

Strikes With Substantial

Engine Damage

Percent of All Strikes With Substantial

Engine Damage

Departure 15,377 1,938 12.6 916 6.0

Takeoff roll 7,995 980 12.3 449 5.6

Initial climb 7,382 958 13.0 467 6.3

En route 383 37 9.7 7 1.8

Descent 1,466 78 5.3 18 1.2

Arrival 23,060 1,327 5.8 270 1.2

Approach 16,408 905 5.5 212 1.3

Landing roll 6,652 422 6.3 58 0.9

Total 40,286 3,380 8.4 1,211 3.0

Source: Richard A. Dolbeer

Table 2

Phase of Flight in Hull Loss Bird Strikes, 1968–20051

Turbofan-Powered Aircraft Turbojet-Powered Aircraft All Turbine-Powered Aircraft

Phase of FlightNumber of Incidents

Percent of Total

Number of Incidents

Percent of Total

Number of Incidents

Percent of Total

Departure (takeoff roll and initial climb) 17 94 6 100 232 96

En route 1 6 0 0 13 4

Arrival (approach and landing roll) 0 0 0 0 0 0

Total 18 100 6 100 24 100

1. Data include all known bird strike–related hull loss accidents worldwide involving turbofan and turbojet transport aircraft greater than 12,500 lb/5,700 kg maximum takeoff weight.

2. In 20 of the 23 departure accidents, one or more engines were damaged by bird ingestions. In two accidents, it was undetermined if birds were ingested into engines, and in one accident, the landing gear was struck.

3. A bird struck the radome.

Source: Richard A. Dolbeer

Table 1


AirportoPs

The data, and especially the find-ing that only two hull losses resulted from the combined 945 turbofan and turbojet bird strikes during departure, are indicative of the robust qualities of turbine engines, the ability of modern aircraft to be operated with less than full power and the skill of today’s flight crews.

Nevertheless, the aviation indus-try cannot afford to be complacent, especially because populations of many large, flocking birds are increasing and the birds are adapting to airport environments.6 Efforts to eliminate bird strikes must focus on detecting hazardous birds in the airport environ-ment and dispersing them, especially

keeping them out of the paths of de-parting aircraft (see “Wildlife Hazards at Smaller Airports”).

The increase in bird populations is a primary reason for the worldwide increase in bird strikes. In addition, however, the population growth has coincided with the increasing use of relatively quiet turbofan aircraft, which

general aviation airports in the United States experience wildlife problems similar to those affect-

ing major airports, but they also face unique challenges — often including a shortage of resources for coping with bird strikes.1

In a presentation prepared for delivery in May at Flight Safety Foundation’s 53rd annual Corporate Aviation Safety Seminar (CASS), three wildlife services officials said that the U.S. Federal Aviation Administration (FAA) database of wildlife strikes involv-ing civil aircraft does not fully reflect the extent of the problem at smaller, general aviation airports.

Of the 73,500 wildlife strikes in the database for the period 1990–2006, about 4,000 occurred at general aviation airports, which typically are located in more rural areas than major airports, lack fencing to exclude deer and other large animals and have limited funding — or no funding — for the implementation of wildlife hazard mitigation programs, according to the presentation. However, the wildlife of-ficials estimate that less than 5 percent of strikes at general aviation airports are reported.

For occurrences that were reported for the period 1990–2006, data show that two-thirds of all 36 wildlife-induced hull losses of civil aircraft in the United States involved general aviation aircraft with maxi-mum takeoff weights of up to 59,500

lb/27,000 kg2 and occurred at general aviation airports, the presentation said.

In addition, 15 percent of the 1,378 strikes that resulted in aircraft damage and 18 percent of the 449 strikes that caused substantial damage occurred at general aviation airports, and 59 per-cent of the 729 wildlife strikes involving deer were reported at general aviation airports, the presentation said.

“These higher damage rates at [gen-eral aviation] airports are likely related, at least in part, to the fact that the [general aviation] aircraft typically using these airports have less stringent airworthi-ness standards related to wildlife strikes, compared to commercial transport aircraft,” the wildlife officials said.

They said that the specific issues that must be addressed at general aviation airports include “methods of funding wildlife hazard mitigation programs, economical deer-proof fencing, training of airport personnel in mitigation techniques and improved reporting of wildlife strikes. These safety issues will be of increasing im-portance in the coming decades, given the interest in air taxi services provided by very light jets (VLJs).”

VLJs used in air taxi service are ex-pected to make extensive use of general aviation airports that are not certificated and regulated for passenger service in accordance with U.S. Federal Aviation Regulations Part 139, which applies to about 570 airports that routinely serve

air carrier aircraft. Among other things, Part 139 certification requires airports that experience wildlife hazards to develop wildlife hazard management plans; the estimated 14,377 general aviation airports typically are not re-quired to address wildlife issues.

The presentation recommended several actions to minimize wildlife strikes at general aviation airports, including reporting all observed wild-life hazards to airport management; delaying takeoffs until birds in runway areas have been dispersed by airport operations personnel; prohibiting the feeding of birds on airport property and ensuring that food waste is inac-cessible to birds; reporting all wildlife strikes; and providing education and guidance on these matters for pilots and maintenance personnel.

— Linda Werfelman

Notes

1. Dolbeer, Richard A.; Begier, Michael J.; Wright, Sandra E. “Animal Ambush: The Challenge of Managing Wildlife Hazards at General Aviation Airports.” In Proceedings of the 53rd annual Corporate Aviation Safety Seminar. Alexandria, Virginia, U.S.: Flight Safety Foundation, 2008.

2. Of the 24 aircraft destroyed in wildlife strikes at general aviation airports, two had maximum takeoff weights from 5,701–27,000 kg/12,500–59,500 lb, eight had maximum takeoff weights of 2,551–5,700 kg/5,600–12,500 lb, and 14 had maximum takeoff weights of less than 2,551 kg/5,600 lb.

Wildlife Hazards at Smaller Airports


AirportoPs

are more difficult for birds to detect and avoid than older aircraft with noisier engines.7,8

At some airports, wildlife hazard management plans (WHMPs) have been implemented to minimize the risk of bird strikes and other wildlife strikes. WHMPs typically call for removing habitat and food that appeal to wildlife; using techniques to disperse hazard-ous wildlife; and establishing an airport wildlife hazard working group to edu-cate the airport community about the risks of wildlife strikes and to monitor and coordinate wildlife control activi-ties. WHMPs should include provisions for inspecting runways that have been idle and dispersing birds before aircraft departures.

These plans should be developed and overseen by professional biologists with training in wildlife damage management and knowledge of the state and federal laws that protect some species.

The International Birdstrike Com-mittee has adopted recommended standards titled “Best Practices for Aerodrome Bird/Wildlife Control” to address this issue.9 One standard says that a “properly trained and equipped bird/wildlife controller should be pres-ent on the airfield for at least 15 min-utes prior to any aircraft departure or arrival. … The controller should not be required to undertake any duties other than bird control during this time.”

Pilots who see birds on the runway should notify air traffic control (ATC)

and delay departure until the birds have been dispersed. When ATC person-nel see birds on or near a runway, they should notify the pilots of departing aircraft, who should delay takeoff until the birds have been dispersed, and airport operations personnel, who should see that dispersal activities are performed.

In the United States, air traffic con-trollers are required to issue advisory information on bird activity that is reported by pilots, observed by control-lers, or detected by radar and verified by pilots.10 These and other related is-sues should be discussed by an airport’s wildlife hazard working group to en-sure that ATC, commercial air carriers and others within the aviation commu-nity understand the risks of bird strikes and that procedures can be developed to limit the possibility of takeoffs while flocks of hazardous birds are on or near runways. Bird-detecting radar also may be useful in these efforts.11

In addition, flight crew training should include response scenarios to the single- and multi-engine ingestions of birds during departure. ●

Richard A. Dolbeer is the national coordinator of the U.S. Department of Agriculture’s Airport Wildlife Hazards Program.

Notes

1. Information about bird strike–induced hull losses was gathered from presenta-tions to International Birdstrike Committee meetings by Thorpe, J. in 2003 and 2005, by Richardson, W.J., and West, T., in 2000; and

from Cleary, E.C.; Dolbeer, R.A.; Wright, S.E. Wildlife Strikes to Civil Aircraft in the United States, 1990–2006. U.S. Federal Aviation Administration (FAA), Serial Report No. 13 DOT/FAA/AS/00-6 (AAS-310). 2007.

2. Information about reported bird strikes in the United States from 1990–2006 was gathered from the FAA National Wildlife Strike Database.

3. Dolbeer, R.A. “Height Distribution of Birds Recorded by Collisions With Aircraft.” Journal of Wildlife Management Volume 70 (December 2006): 1345–1350.

4. Banilower, H.; Goodall, C. Bird Ingestion Into Large Turbofan Engines. DOT/FAA/CT–93/14. Atlantic City, New Jersey, U.S.: FAA Technical Center. 1995.

5. Martino, J.P.; Skinn, D.A.; Wilson, J.J. Study of Bird Ingestions Into Small Inlet Area, Aircraft Turbine Engines. DOT/FAA/CT–90/13. Atlantic City, New Jersey, U.S.: FAA Technical Center. 1990.

6. Dolbeer, R.A.; Eschenfelder, P. “Amplified Bird Strike Risks Related to Population Increases of Large Birds in North America.” In Proceedings of the 26th International Bird Strike Committee Meeting (Volume 1). Warsaw, Poland, 2003.

7. Burger, J. “Jet Aircraft Noise and Bird Strikes: Why More Birds Are Being Hit.” Environmental Pollution (Series A). 30: 143–152.

8. Kelly, T.C.; O’Callaghan, M.J.A.; Bolger, R. “The Avoidance Behavior Shown by the Rook (Corvus frugilegus) to Commercial Aircraft.” In Advances in Vertebrate Pest Management II, H.J. Pelz, D.P. Cowan and C.J. Feare, editors. Filander Verlag. 2001.

9. International Birdstrike Committee. Standards of Aerodrome Bird/Wildlife Control, Recommended Practices No. 1. October 2006.

10. FAA. Order 7110.65R. Air Traffic Control. Feb. 16, 2006. Chapter 2, Section 1, Paragraph 22.

11. Blokpoel, H.; MacKinnon, B. “The Need for a Radar-Based, Operational Bird-Warning System for Civil Aviation.” In Bird Strike 2001, Proceedings of the Bird Strike Committee–USA/Canada Meeting, Calgary, Alberta, Canada: Transport Canada. 2001.

© Nacho Piédrola/Airliners.net

| 27www.flightsafety.org | AeroSAfetyworld | june 2008

seminarsCASS

details on the wisdom and the ways of incorporating safety management systems (SMS) into corporate flight depart-

ments dominated the presentations and discussions at the 53rd annual Corpo-rate Aviation Safety Seminar (CASS) in Palm Harbor, Florida, U.S.

During the meeting, a joint presen-tation of Flight Safety Foundation (FSF) and the U.S. National Business Aviation Association, flight department manag-ers and aviation safety professionals detailed their progress installing SMS tools and procedures into their opera-tional frameworks.

A common theme relating to SMS implementation was the importance of

having support from the highest levels of corporate management. Rick Boyer, chief pilot for SCANA, a Southeast U.S. power company, took that theme one step higher, saying, “Our safety culture has to be a subset of the larger compa-ny’s culture. We cannot coexist if we’re not part of the same culture.”

Boyer’s co-presenter, Tom Garcia, formerly a U.S. Navy safety specialist and now a consultant, cited statements by several organizations that a posi-tive safety culture is a prerequisite for implementation of an SMS. For example, the International Civil Aviation Organi-zation said, “Before an organization can implement an effective SMS, it needs to possess an appropriate safety culture.”

“Culture,” Garcia added, “is a group phenomenon … the learned and shared assumptions, values and beliefs that re-sult in the behavior of an organization.”

But conclusions about the state of the current safety cultures mean more than just making assumptions, he said. The U.S. National Aeronautics and Space Administration thought it had a good safety culture following the inves-tigation of the 1986 Challenger space shuttle disaster, only to learn through the loss of the Columbia shuttle in 2003 that “it was still a broken safety culture, unchanged in the 17 years between shuttle disasters.

“The common thread [in managers mis-analyzing their own safety culture]

SMS Aspects at CASS

Threat and error management becomes part of

the safety management system dialogue.

By J.A. Donoghue | from PAlm hArBor

© Ji

m Ju

rica

and

Jam

es W

arre

n/iS

tock

phot

o.co

m

28 | flight safety foundation | AeroSAfetyworld | june 2008

seminarsCASS

is that there is always at least one as-sumption [of an effective culture that] no one else could see,” he said.

Maria Jeanmaire, team leader, aviation safety, and a pilot for the Harley-Davidson Motor Co., said Harley-Davidson (H-D) adopted SMS in 2004 during its IS-BAO (Interna-tional Standard for Business Aircraft Operations) registration, “although that is not necessary.” Since then, the company has commissioned an an-nual audit, twice as often as required by IS-BAO, because that’s what is needed for the company’s ISO 9000 certification.

Getting and sustaining employee commitment to the process is essen-tial, she said, and H-D achieves that commitment through a process that includes communicating benefits, rewarding participation, enforcing accountability, embracing change and demanding excellence.

In an SMS, change is not only pos-sible, “it is routine,” she said. “SMS is a living document.”

In considering an SMS, it is im-portant to realize that “safety is not ‘first.’ Safety is the mortar between everything you do. It permeates all of it,” said Michael L. Barr, director of the Aviation Safety Program at the Uni-versity of Southern California’s Viterbi School of Engineering. Barr noted that SMS had its roots in ISO 9000 quality

management systems (QMS), but the ISO 9000 was a reactive process, not data driven, so “some things were not getting done,” a failing which led to the development of SMS.

Another flight department to appre-ciate the strong link between IS-BAO and SMS is Daedalus Aviation Services, where David Bjellos is president. “The IS-BAO framework of best practices is a great start toward SMS.”

Even if your flight department is a safe operation in a safe segment of the industry, SMS “will take you to the next level. Risks still exist, and SMS will make you safer,” he said.

The goal of a unified company safety culture was achieved in an unusual way at Agro Industrial Man-agement, Daedalus’s parent company. “An unintended consequence of our aviation SMS is that it migrated to our primary business — agriculture. The QMS in place was well established and incorporated many protocols to miti-gate loss. When we introduced SMS, they saw something in our system that was lacking in the manufactur-ing side, and the QMS was revised to include the checklist style procedures we used.”

In Bjellos’ opinion, “The com-mon thread of open communications removes the barriers to an effective SMS program. Without that, SMS is just another document. But by

proactively addressing issues daily, our group is able to discuss anything freely about any part of the flight operation.”

The first step down the road to an SMS, said Darol V. Holsman, FSF manager, safety audits, “is a gap analysis,” comparing the exist-ing system with the SMS defined in several documents. Holsman recom-mended Transport Canada’s Advisory Circular 107-001, Guidance on Safety Management Systems Development; the slightly older U.S. Federal Avia-tion Administration AC 120-92 and the International Business Aviation Council’s “Tools for Efficient SMS De-sign,” which Holsman called “the best tool we have found for all categories of flight operators,” including those with no SMS or safety program experience, or an initial IS-BAO Stage I. He added, “An SMS linkage with IS-BAO is not mandatory.”

Ultimately, Holsman said, “the key to success in SMS is documenta-tion, documentation, documentation. Implement your plan with milestones to measure your success. The overall goal of an SMS should be to reduce risk to a level as low as reasonably practi-cable,” a standard Holsman offers as the acronym ALARP. Goals should be set that are both strategic for long-term achievement, and tactical for short-term implementation.

| 29www.flightsafety.org | AeroSAfetyworld | june 2008

seminarsCASS

Numerous speakers stressed the importance of developing an SMS ap-propriate for the operations, aircraft and personnel of the department under consideration.

Boyer reported that when SCANA started its SMS under then-chief pilot Robert Sumwalt, now vice chairman of the National Transportation Safety Board, early in the process “we looked at the haz-ards experienced by similar flight depart-ments flying similar missions,” swapped safety advisers between companies for a while, and joined a peer review group with 20 flight departments to make up the Southeast Aviation Safety Roundtable.

For the second consecutive CASS, Peter N. Stein, base manager and chief pilot for Johnson Controls, discussed threat and error management (TEM), a system that has gained great acceptance in the airline community but is just beginning to take hold in the corporate aviation world as an important hazard identification tool.

Unconsidered threats can result in errors, he said. TEM goes beyond just identifying the threats and errors to include developing strategies and countermeasures should errors occur to arrive at a desirable outcome.

“A threat is any influence external to the operator, both expected and unexpected, that may reduce safety margins,” he said, adding, “intentional noncompliance is not an error.”

Examples of mismanaged threats include failure to activate engine anti-ice before entering icing conditions, an unstable approach, failing to stow galley equipment before entering moder-ate turbulence, an engine access panel unsecured before dispatch and leaving wing trailing edge static wicks without warning flags on parked aircraft.

The point of TEM is to avoid “un-desired states, a condition that clearly reduces safety margins.”

TEM strategies should be included in simulator recurrent training, which now focuses on technical skills and procedures, creating a gap between technical and nontechnical skills, Stein said.

Adding TEM to simulator training should begin with a classroom discussion of TEM applied to known accidents, a brainstorming session that fits neatly into SMS processes, he said. “Then design simulator scenarios to explore typical errors, applying undesired-state manage-ment” to achieve a good outcome. The pre-training briefings should mirror what ideally is done before each flight, listing the expected threats, discuss-ing strategies to manage those threats, anticipating the potential for common error-producing conditions and the employment of error-resistance counter-measures, he said.

Incorporating TEM into simula-tor training “results in a higher degree

of realism and developing a system-atic mindset to using TEM, allowing abstract concepts to become more concrete.” However, TEM should not be injected into initial simulator training sessions, where technical skills and operating procedures must take prece-dence, Stein added.

Turning to operational issues, Donald D. Trekell Jr., CAE Simu-Flite’s lead instructor, advanced programs, said that while automation is more necessary than ever to deal with increasingly complex airspace environments, a higher reliance on automation makes operators more vulnerable to hazards. The pace of air traffic control reduces the amount of time available to manage automation, Trekell said. The increased workload of managing the automation “consti-tutes a new threat, with more pro-cedures, last-minute changes, lower [approach] minimums, more precise navigation and less [aircraft] separa-tion” combining to boost the potential for pilot task saturation, he said.

Automation also decreases situ-ational awareness, in part because the systems are so reliable “we tend to trust them” and become less aware of other tools, such as charts, Trekell said. This, in turn, means pilots “are less prepared for unexpected changes, less prepared for malfunctions, and are easier to surprise.” ●

Speakers from left,

Boyer, Holsman and Trekell

Photos: J.A. Donoghue

© C

hris

Sore

nsen

Pho

togr

aphy

30 | flight safety foundation | AEroSAfEtyWorld | June 2008

flighttECH

30 |

the Flight Deck Automation Working Group, a U.S. government-industry com-mittee launched in 2006, is scheduled to complete next year an assessment of

how well airlines have addressed safety vulner-abilities identified in flight deck automation, including the effectiveness of efforts to improve mode awareness during autopilot/flight director operation and to mitigate mode confusion.

Mode awareness/confusion has been de-scribed as situations in which “the flight crew

believe they are in a [flight guidance system] mode different than the one they are actually in and consequently make inappropriate requests or responses to the automation” or in which “the flight crew does not fully understand the behavior of the automation in certain modes, i.e., when the crew have a poor ‘mental model’ of the automation.”1 Sometimes, this is simply called losing track of the automation.

The subject has been studied for decades. “The current set of autoflight modes is large and

Check-up targets

efforts to mitigate

complexity of flight

guidance systems.

Au

tofl

igh

t A

ud

it

By Wayne RosenkRans

| 31WWW.flightsafety.org | AEroSAfEtyWorld | June 2008

flighttECH

has expanded over the years: A typical transport may have approximately 25 thrust, lateral and vertical modes,” said a 2004 report by Boeing Commercial Airplanes researchers. “The complex rules behind vertical navigation and other modes sometimes make it dif-ficult for pilots to anticipate aircraft flight path behavior. … Boeing research shows that some pilots incorrectly as-sume that all vertical navigation modes always take altitude targets from the flight plan [programmed into the flight management system]. … Although the flight mode annunciation on the prima-ry flight display highlights changes with a transient green box, Boeing research indicates that 30–40 percent of these changes go undetected.”2

Previous solutions primarily focused on policies, procedures and training pending the adoption of new airwor-thiness standards for flight guidance systems — completed in 2006 in the United States — and the arrival of more human-centered flight deck technology.

The airline accident most often cited for raising consciousness of the mode awareness/confusion issue oc-curred in April 1994 when the flight crew of an Airbus A300 experienced loss of control and crashed during an approach to Nagoya, Japan (ASW, 10/06, p. 44). The U.S. Federal Aviation Administration (FAA) later said, “Con-tributing to that accident were conflict-ing actions taken by the flight crew and the airplane’s autopilot.”

A Broad AssessmentEstablished by the Performance-Based Operations Aviation Rulemaking Committee (PARC) and the U.S. Com-mercial Aviation Safety Team (CAST), the Flight Deck Automation Working Group’s findings and recommendations are expected to help airlines, and other

specified types of operators, optimize pilot training, among other objectives. The FAA said in May 2008 that this PARC/CAST working group is mak-ing progress but could not yet discuss its ongoing deliberations. In earlier communication, however, the work-ing group said, “In the past decade, major improvements have been made in the design, training and operational use of on-board systems for flight path management (autopilot, flight director, flight management systems, etc. and their associated flight crew interfaces [Figure 1]). In spite of these improve-ments, incident reports suggest that flight crews continue to have problems interfacing with the automation and have difficulty using these systems. But appropriate use of automation by the flight crew is critical to safety and to effective implementation of new operational concepts, such as required

navigation performance (RNP) and area navigation (RNAV).”

The working group also said that its scope of work includes updating and revising safety recommendations from a June 1996 report by the FAA Human Factors Team,3 reviewing airline crews’ recent experience with flight deck sys-tems in situations such as RNP RNAV approaches and departures, analyz-ing recent accident/incident data, and recommending and prioritizing best practices — possibly via a training aid — to enhance operational use of these systems.

Ten years ago, the Automation Sub-committee of the Human Factors Com-mittee of the Air Transport Association of America (ATA) updated policy guidance for members on potential im-provements in pilot training. The ATA said at the time, “We believe that action is required in the near term by carriers

Flight Control System Automation Overview

Crew selections1

Crewindications2

Flightmanagement

system

Crew interface

Flight guidance system

Mode logic

Flight control laws

Aircraft statesensor data

Measured state

Rollguidance

Pitchguidance

Flight control panel

Primary flightdisplays

Flight directorguidance cues

(Electronic �ightinstrument system)

Autopilot Controlsurfaces

Actuator

commands

On/o�

Engage/disengage

Notes

1. Buttons pressed and knobs set on flight control panel.

2. Indicator lamps illuminated/off on flight control panel and green/white textual mode annunciations on primary flight displays.

Source: Langley Research Center, U.S. National Aeronautics and Space Administration

Figure 1


flighttECH

or their pilots to prevent commonly occurring [mode] errors.”4

More recent incentives to sustain industry attention to mode awareness/confusion include an international initiative to replace nonprecision ap-proaches with “precision-like” ap-proaches that take full advantage of the existing flight guidance systems in airline fleets, RNP RNAV operation and global navigation satellite systems in areas of the world that lack modern infrastructure and precision approach guidance (ASW, 9/07, p. 20).

The Global Aviation Safety Road-map (ASW, 1/07, p. 28) also envisions wider use of autoflight technology. The plan encourages airlines to implement use of a flight path target–flight path director or vertical modes of the auto-pilot, flight director and flight manage-ment system, or both, to reduce the risk of approach-and-landing accidents. These efforts may have to overcome existing automation policies prohibiting pilots from using some flight guidance system modes and/or requiring them to use other modes.5

Latest Pilot ReportsThe captain of a Boeing 757, in a Febru-ary 2007 report to the U.S. National Aeronautics and Space Administration (NASA) Aviation Safety Reporting

System (ASRS), said, “Upon receiving approach clearance [at 10,000 ft on radar vectors], the first officer [as pilot flying] selected 6,100 ft … on the airplane mode control panel [manufacturers use different terms, including flight control panel (Figure 2)], and flight level change [as] the descent mode. Flight level change [mode] provided no protection for subsequent altitude restrictions on the approach. I was verifying the flight management system programming and ascertaining the aircraft position rela-tive to ATANE intersection (minimum crossing altitude 10,000 ft MSL) as we began our descent. The aircraft was at approximately 9,400 ft slightly outside ATANE when I directed the first officer to pull up.”6

The captain of a McDonnell Doug-las DC-9 in February 2007 reported, “After leveling at Flight Level 340 [ap-proximately 34,000 ft], my first officer (the pilot flying) … wiped his fingers, the throttles and the autopilot [mode] control panel with a wet wipe [and] inadvertently knocked the autopilot out of the altitude hold mode and into climb mode. We did not imme-diately notice the slow climb because of continuous light turbulence. When the altitude alerter [activated] at 34,250 ft, the first officer disconnected the autopilot and descended back to Flight

Level 340. The altitude deviation was probably about 300 ft [in reduced verti-cal separation minimum airspace when ATC contacted the crew].”7

The captain of a 737-700 in Decem-ber 2007 reported, “[As pilot flying, I] had the aircraft in heading select and vertical speed modes. In the turn [to 325 degrees], passing through approxi-mately 300 degrees, we encountered moderate wake turbulence from a pre-ceding aircraft. We did not recognize at the time that the flight director roll mode changed to control wheel steering mode from heading select mode after encountering the wake. … Neither of us recognized that the aircraft went past the assigned heading in control wheel steering mode until air traffic control issued a corrective heading and advised ‘no delay’ on our climb through Flight Level 260 for traffic. Total course devia-tion was about 70 degrees.”8

Flight FollowingThe Flight Deck Automation Issues Web site <www.flightdeckautomation.com>, funded by the FAA and operated by a contractor for safety research by the public, has accumulated evidence of mode awareness/confusion while tracking 94 human factors issues in flight deck automation. Two of the most relevant issues tracked regarding

Generic Flight Control Panel for Human Factors Research

ALT = altitude hold mode/altitude selector; AP ENG = autopilot engage/disengage; CRS = course selector; FD = flight director on/off; FLC = flight level change mode; HDG = heading select mode/heading selector; APPR = lateral approach mode; NAV = lateral navigation mode; VS = vertical speed mode


Figure 2

http://www.flightsafety.org/asw/jan07/asw_jan07_p28-31.pdf

http://www.flightsafety.org/asw/sept07/asw_sept07_p20-21.pdf


flighttECH

mode awareness/confusion are “mode awareness may be lacking” and “mode selection may be incorrect.”

According to the Web site, the most compelling evidence that inadequate mode awareness can have fatal/severe consequences is the accident investiga-tion report from a 1992 Airbus A320 accident in France and the 1995 report of a flight simulator experiment in which 11 of 12 pilots deviated signifi-cantly from the intended flight path after researchers induced uncommand-ed vertical mode changes, even though each mode change was annunciated normally. The A320 accident report noted that “the abnormally high rate of descent was the result of an uninten-tional command on the part of the crew because they believed the vertical mode selected on the autopilot to be other than that which was actually selected,” the Web site said.

The strongest example of incor-rect mode selection cited by the Web site is the accident investigation report from the 1979 DC-10 inadvertent stall accident over Luxembourg. The U.S. National Transportation Safety Board’s accident report said, “When the captain selected 320 kt into the autothrust sys-tem speed window, he may have either intentionally or unintentionally pulled the autothrust system speed selector knob. The action would have changed the autothrust selection from the N1 mode to the airspeed mode. This in turn would have caused the autopilot IAS [indicated airspeed] HOLD mode to disengage and revert automatically to the vertical speed mode of operation. … The autopilot commanded an in-creasing angle-of-attack while attempt-ing to maintain a preselected vertical speed, which exceeded the limit thrust performance capability of the aircraft at higher altitudes.”9

Airworthiness StandardsIn May 2006, an amendment to U.S. Federal Aviation Regulations (FARs) Part 25.1329, Flight Guidance System — the first amendment since 1964 — be-came effective. The European Aviation Safety Agency and the FAA harmo-nized these regulations. In the course of rule making for these FARs in 2004, the FAA said, “Studies have shown that lack of sufficient flight crew awareness of modes, transitions and reversions is a significant safety vulnerability. … New-er designs enable functions that were not possible for automated systems when the regulations were adopted. … The newer designs also tend to be more complex from the crew’s perspective, and vulnerable to flight crew confusion over mode behavior and transitions.”10

During design, manufacturers are now asked to consider specific past sources of mode awareness/confusion: Pilots have confused knobs for setting the airspeed command reference target versus the heading target on the mode control panel because knobs were not differentiated by shape and position; erroneous entries of targets have been made by pilots operating a single switch, such as a concentric rotary switch, to select diverse categories of targets; misinterpretation has resulted from inconsistent arrangement of the mode control panel, compared with the arrangement of flight mode annuncia-tions on the primary flight display (Fig-ure 3, p. 34); pilots have mixed up the autopilot and autothrust controls; and pilots inadvertently have changed flight modes because of the light control force required to operate a switch.

In FAA Advisory Circular 25.1329B, Approval of Flight Guidance Systems, special attention has been given to op-erationally relevant mode changes. The FAA said, “Annunciation of sustained

speed protection should be clear and distinct to ensure flight crew awareness. … The transition from an armed mode to an engaged mode should provide an additional attention-getting feature, such as boxing and flashing on an electronic display … for a suitable, but brief, period (for example, 10 seconds) to assist in flight crew awareness.”

Aural alerts may be warranted when, for example, the autopilot holds a sustained lateral control command or pitch command to compensate for an unusual operating condition, or the airplane nears the limits of the autopilot design in the pitch axis, roll axis or the amount of trim applied unintentionally in either axis. The advisory circular, and some human factors specialists, refer to such alerts as bark before bite. “A timely alert enables the pilot to manually disengage the autopilot and take control of the airplane prior to an automatic disengagement caused, for example, by a lateral condition such as asymmetric lift and/or drag caused by airframe icing, fuel imbalance or asym-metric thrust,” according to the AC.

Solutions at Hand CAST worked earlier in this decade with air carriers and manufacturers on the mode awareness/confusion issue to generate safety enhancements as a “short-term tactical solution” for reducing the risk of loss of control. CAST safety enhancements appear in a February 2003 report by the CAST Joint Safety Implementation Team.11 One example is no. 36, which says, “De-velop specific guidelines for eliminating mode confusion. Implement guidelines on new [airplane] type designs and study the feasibility of implementing guidelines on existing type designs. Implement changes per the feasibil-ity study. … To avoid problems due to


flighttECH

unexpected mode changes, automated flight sys-tem logic should be designed to be error-toler-ant or, at a minimum, provide an alert when the desired mode is in conflict with aircraft energy

state. … To ensure flight crews have a compre-hensive knowledge of the automation system(s) functional operation, airlines/operators should ensure that their training/standardization pro-grams emphasize these skills.”

The ATA’s key recommendation was that pilots deliberately scan the flight mode annun-ciations to determine whether autopilot and/or autothrust are engaged and in what modes — not merely to confirm the result of each auto-flight mode selection considering that so many mode changes are designed to happen without pilot action. Another suggested countermeasure was collecting and analyzing all mode aware-ness/confusion events, etc. through a pilot voluntary reporting system and, if required, proactively “changing the expectation” of pilots by highlighting the identified issues in training.

Mode awareness/confusion also has been addressed by the Flight Safety Foundation Approach-and-Landing Accident Reduction Tool Kit. Examples of the tool kit’s recommended countermeasures are checking that the knob or push-button is correct for the desired function before each mode/target selection, monitoring the flight mode annunciation and calling out all mode changes in accordance with standard operating procedures, and cross-checking the altitude entered on the mode control panel with the selected altitude shown on the primary flight display.

The 2004 revision of the Airplane Upset Recovery Training Aid also contains relevant information.12 An FSF safety seminar presenta-tion by Boeing in October 2007 highlighted this training aid and cited several pilot-induced errors involving maneuvering at high altitude in a mode that does not protect against thrust and buffet margins.

“When using LNAV [lateral navigation] mode during cruise, the mode provides real-time bank angle–limiting functions and will keep the commanded bank angle from exceed-ing the currently available thrust limit,” Boeing said. “This protection is not available when LNAV mode is deactivated. Heading select mode does not protect against too much bank.

Generic Primary Flight Display for Human Factors Research

ROLLHDGNAVLAPPRGA

PTCHVSFLCALTALTSVAPPRVGA

Roll mode engaged1

Pitch mode engaged2

Pitch mode armed

Autopilotengagedindicator

Pilot �yingindicator

Flight director

guidancecues

ALT = altitude hold mode; ALTS = altitude select mode; FLC = flight level change mode; GA = lateral go-around mode; HDG = heading select mode; LAPPR = lateral approach mode; NAV = lateral navigation mode; PTCH = pitch hold mode; ROLL = roll hold mode; VAPPR = vertical approach mode; VGA = vertical go-around mode; VS = vertical speed mode

Notes

1. One engaged roll mode and one engaged pitch mode appear in green on the first line.

2. One armed roll mode and one armed pitch mode appear in white on the second line.

3. Autothrust modes typically annunciated on the primary flight display were not included in this example.


Figure 3


flighttECH

And often when maneuvering around storms … crews have left the bank angle setting at something used during low-altitude operations. … A common technique [in threat and error manage-ment] is to set the mode control panel bank-angle selector to 10 degrees when at cruise.”13

On the Drawing BoardThe focus of a team from the NASA Langley Research Center and Rockwell Collins reflected one of the major re-search directions: in-depth human feed-back for qualitative insights combined with exhaustive mathematical probing of flight guidance system models by other software for quantitative validations of mode logic and behavior. In the late 1990s, this team created its first soft-ware model of a flight guidance system, connected it to a desktop computer simulation of a flight deck and reviewed the mode behavior and human-machine interface with avionics design engineers, pilots and human factors specialists.

Their second strategy applied software engineering, specifically two formal analysis methods in which out-puts of mathematical formulas change in response to inputs of different variables, called model checking and theorem proving. This strategy enabled software-based “exploration” of all possible scenarios and combinations of modes — how, for example, some pilot inputs are ignored as irrelevant by the active mode logic. These researchers said in 2003, “Even though our [formal analysis of a simplified model of a regional jet flight guidance system] was only partial, we were able to find hidden modes, ignored operator inputs, unintended side ef-fects, lack of feedback regarding current modes, and surprises in how off-normal modes can be entered and exited in our example specification.”14

As one example of related activi-ties by airframe manufacturers, Boeing has been communicating through FSF safety seminars and aviation human-computer interface conferences its efforts to rethink flight guidance system design, test prototypes and provide supplemental educational modules in support of deeper pilot understanding of existing automation behavior.

A clean-slate design for a future flight guidance system has been pre-sented at industry conferences. One Boeing presentation, for example, said that this new design has discarded the concept of pilots memorizing rules for each mode — a limitation imposed decades ago by the avionics architec-ture itself — with “indications directly related to flight path behavior (e.g., CLIMB, LEFT TURN).”

By starting from scratch, the designers gained the opportunity to make each automated method of flight conceptually correspond with the manual method used by pilots; make infrequent tasks as simple as common tasks; clarify when flight is linked/un-linked to strategic targets in the flight management system or tactical targets entered on the mode control panel; and provide a “preview line” for tactical target entries. They said, “In the new design, approach, landing, go-around and even taxi guidance use the same modes and interfaces as up-and-away flight, resulting in only seven modes to cover the entire domain and provid-ing an extreme level of simplicity and consistency.” ●

Notes

1. Joshi, Anjali; Miller, Steven P.; Heimdahl, Mats P.E. “Mode Confusion Analysis of a Flight Guidance System Using Formal Methods.” In proceedings of the 22nd Digital Avionics Systems Conference in Indianapolis, Indiana, U.S., October 2003.

2. Boorman, Daniel J.; Mumaw, Randall J. “A New Autoflight/FMS Interface: Guiding Design Principles.” Paper presented to the 2004 International Conference on Human-Computer Interaction in Aeronautics in Toulouse, France, September 2004.

3. FAA Human Factors Team. “The Interfaces Between Flightcrews and Modern Flight Deck Systems.” June 18, 1996. Reprinted by Flight Safety Foundation in the October 1996 Flight Safety Digest.

4. ATA Automation Subcommittee, Human Factors Committee. “Potential Knowledge, Policy or Training Gaps Regarding Operation of FMS-Generation Aircraft – Second Report.” June 1998.

5. Sherman, P.J.; Helmreich, R.L.; Merritt, A. “National Culture and Flight Deck Automation: Results of a Multination Survey.” International Journal of Aviation Psychology Volume 7/4, 1997. Cited on <www.flightdeckautomation.com>.

6. NASA ASRS report no. 728889, February 2007.

7. NASA ASRS report no. 726182, February 2007.

8. NASA ASRS report no. 767601, December 2007.

9. NTSB. Aeromexico DC-10 Over Luxembourg, November 11, 1979. Aircraft Accident Report no. NTSB/AAR-80-10, 1980. Cited on <www.flightdeckautoma-tion.com>.

10. FAA. “Safety Standards for Flight Guidance Systems.” Notice of proposed rule making no. 04-11. Aug. 13, 2004.

11. CAST. “Loss of Control (LOC) Joint Safety Implementation Team Report.” Feb. 15, 2003.

12. Upset Recovery Industry Team. Airplane Upset Recovery Training Aid, Revision 1. Aug. 6, 2004.

13. Carbaugh, Dave. “Threat and Error Management (TEM) and High Altitude Operations.” Presentation to the Flight Safety Foundation International Air Safety Seminar in Seoul, Korea. October 2007.

14. Joshi et al.


cAuSAlfactors

the flight crew’s attention was focused on troubleshooting an inertial reference system (IRS) problem, and neither pilot was

monitoring the flight instruments when the autopilot disengaged and the Boeing 737‑400 began to roll and pitch nose‑down, said the Indonesian National Transportation Safety Com‑mittee (NTSC). The pilots apparently became spatially disoriented and did not conduct the appropriate proce‑dures to recover from the upset. The 737 descended into the Makassar Strait, near Sulawesi, Indonesia; all 102 people aboard were killed.

The accident occurred Jan. 1, 2007, during a scheduled flight from Sura‑baya, East Java, to Manado, Sulawesi, with 96 passengers and six crewmem‑bers. The flight was operated by Adam

SkyConnection Airlines as AdamAir Flight 574.

Both pilots were Indonesian. The pilot‑in‑command (PIC), 47, was the pilot flying. He had 13,356 flight hours, including 3,856 flight hours as a 737 PIC, and was hired by AdamAir in July 2006. The copilot, 36, had 4,200 flight hours, including 998 flight hours as a 737 copilot. He joined the airline in September 2005.

“There was no evidence that the PIC [or the copilot were] not fit for duty, nor was there any evidence of physi‑ological or psychological problems in the days preceding the accident,” said the NTSC’s final report on the accident.

The 737 was manufactured in 1989 and had accumulated 45,371 flight hours and 26,725 cycles. The report said that the aircraft had “many

previous owners and operators” before AdamAir leased it from a holding company.

Position UnknownThe aircraft departed from Surabaya’s Djuanda Airport at 0559 coordinated universal time — 1359 local time. The crew established the 737 on Airway W32, which extends east‑northeast from Surabaya over the Java Sea to the Makassar VOR (VHF omnidirec‑tional radio) on the southwest coast of Sulawesi, then north‑northeast to Manado, which is on the northern tip of the island (Figure 1).

The 737 was nearing the KASOL waypoint at 0614 when the crew was cleared by air traffic control (ATC) to fly directly to the DIOLA waypoint. About five minutes later, the copilot

© H

olge

r Met

te/iS

tock

phot

o

Off-COUrseConfusion

A navigation problem distracted the AdamAir pilots from flying the aircraft.

BY MARK LACAGNINA


cAuSAlfactors

reported that the aircraft was reach‑ing the assigned cruise altitude, Flight Level 350 (approximately 35,000 ft), and was told by ATC to report abeam the ENDOG waypoint.

About 10 minutes after the copi‑lot acknowledged the instruction to report abeam ENDOG, the air traf‑fic controller who had been handling the flight exclaimed, “Where is Adam direct to? My God, he is flying north.” By this time, however, the flight had been handed off to a different sector controller.

The aircraft was north of the GUA‑NO waypoint (see Figure 1) at 0637 when the new controller told the crew to fly directly to DIOLA. A few minutes later, the controller asked the crew for their heading, and the copilot replied that they were heading 046 degrees, direct to DIOLA. The controller told the crew to fly a heading of 070 degrees to track directly to the waypoint.

At 0655, the copilot asked the controller for their radar position. The controller said that the aircraft was 125 nm (232 km) from the Makassar VOR and crossing the 307‑degree radial.

ATC radar and radio contact with the aircraft were lost at 0658. “The con‑trollers asked a number of aircraft … to help them make contact with AdamAir 574,” the report said. “They were unable to establish contact with the aircraft.”

ATC alerted search and rescue au‑thorities at 0815, which was the flight’s estimated time of arrival at Manado. The search for the aircraft began in the vicinity of the last recorded ATC radar return and was conducted by Indone‑sian military units, the country’s search and rescue organization, the NTSC, the Air Accident Investigation Bureau of Singapore, Singapore navy divers and other resources. On Jan. 10, wreckage was found in the water and spread along

the western shore of Sulawesi, from Baru to Pare‑Pare.

A towed, submersible sonic detector sent by the U.S. Navy to aid the search detected locator beacon signals from the cockpit voice recorder (CVR) and digital flight data recorder (DFDR). Searchers determined that the re‑corders and the main wreckage were 2,000 m (6,562 ft) below the surface of Makassar Strait. The recorders were recovered by a Phoenix remotely oper‑ated vehicle in August 2007. The U.S. National Transportation Safety Board assisted in the recovery of the recorders.

Concerned and ConfusedAnalysis of the DFDR data showed that the autopilot’s heading and altitude‑hold modes had been selected. The aircraft was slightly out of trim, and the autopilot was counteracting its

tendency to turn right; the control wheels were displaced five degrees left.

The report said that the CVR recording — which began at 0628, or about 30 minutes before the upset occurred — indicated that the crew was “concerned and confused” about discrepancies in their IRS data.

A brief description of the IRS serves to explain the navigation problem that confronted the crew and their attempts to resolve it. An IRS — also called an inertial navigation system (INS) — is a self‑contained system that receives no external navigation signals.1 The major components of the 737’s IRS are two inertial reference units (IRUs), each having three sets of laser gyroscopes and accelerometers that independently determine flight data parameters such as position, heading, groundspeed, vertical speed, altitude, attitude, wind

AdamAir 574 Route of Flight

Flight-planned routeAmended route

Pare-Pare

Manado

Makassar VORGUANO

ENDOGKASOL

DIOLA

W32

S U L A W E S I

Baru

Radar contact lost

B O R N E O

Java Sea

Mak

assa

r Stra

it

Surabaya

VOR = VHF omnidirectional radio

Source: National Transportation Safety Committee, Indonesia

Figure 1

Susan Reed


cAuSAlfactors

speed and wind direction by sensing changes in the air‑craft’s movement. IRS data are provided to the flight instruments, flight management system, autopilot and other systems.

An IRS transfer switch and two IRU mode‑selector switch‑es are located on the 737’s overhead panel (Figure 2). The trans‑fer switch has three positions: “BOTH ON L”; “NORMAL”; and

“BOTH ON R.” When “NORMAL” is selected, the PIC’s electronic attitude director indicator (EADI) and electronic horizontal situation indicator (EHSI) receive data from the left IRU, and the copilot’s EADI and EHSI receive data from the right IRU. The other two switch positions are used to channel data either from the left IRU or the right IRU to both pilots’ instru‑ments. The accident aircraft’s IRU transfer switch was selected to

“NORMAL.”Each IRU has a mode‑selector switch with

three positions (Figure 3): “ALIGN,” which is used before departure for position initialization, using the latitude/longitude coordinates for the gate or an airport reference point, and to align the gyros vertically and with true north; “NAV,” for normal navigation; and “ATT,” the attitude

mode, which is used if alignment is lost in flight. When the attitude mode is selected, there is a brief transition period in which the autopilot disengages and several flight data parameters are replaced with failure warnings on the pilots’ flight instruments. The 737’s quick reference handbook (QRH) says that during this period, the aircraft should be hand‑flown straight and level, with no power or configuration changes, until valid pitch and roll parameters are displayed. The QRH notes that the transition period is approximately 30 seconds.

‘Bad Weather’After the crew initially was cleared to fly di‑rectly to DIOLA, the aircraft entered an area of convective activity conducive to the formation of severe icing conditions, hail, lightning and severe turbulence. One of the pilots advised the passengers that the aircraft was entering “bad weather” and told them to return to their seats and fasten their seat belts.

About this time, the navigation problem ap‑parently worsened. “The pilots believed they were off track and were concerned and confused but did not raise any concerns with ATC,” the report said. Among pertinent statements recorded by the CVR were: “We will get lost”; “Crazy, it’s crazy”; “This is really bad”; “The IRS is errone‑ous”; “But the left one is good”; “This is messed up”; “It’s starting to fly like a bamboo ship.”

The statement “but the left one is good” and other statements indicated that the crew sus‑pected that the right IRU was malfunctioning but were confused by the absence of a failure warning. Nevertheless, the PIC eventually decided to use the IRS fault procedure in the QRH to realign the right IRU. He told the copilot to change the mode for the right IRU from navigation to attitude.

“However, after moving the IRU mode selec‑tor switch to ‘ATT,’ they did not comply with the QRH requirement to fly the aircraft straight and level at a constant airspeed for 30 seconds,” the report said. Consequently, when the autopilot disengaged, the aircraft began to roll right 1 to 2 degrees per second. The roll rate subsequently increased to 4 to 5 degrees per second. During

IRS Transfer Switch

IRS = inertial reference system


Figure 2

IRU Mode Selector Switches

IRU = inertial reference unit


Figure 3

WWW.flightsafety.org | AeroSAfetyWorld | june 2008

cAuSAlfactors

| 39

the IRU realignment, the roll indication, hori‑zon scale, pitch scale and sky/ground shading disappeared from the copilot’s EADI.

The investigation verified that the right IRU was malfunctioning. The PIC’s EADI therefore continued to receive valid data from the left IRU. The standby attitude indicator and magnetic compass also were operational. Nevertheless, the PIC did not take positive action to level the wings.

“For about 46 seconds after the autopilot disengaged, the pilots were completely occupied with troubleshooting,” the report said. The roll rate was arrested twice within 15 seconds by manual control input. “But the wheel inputs were momentary, and the aircraft continued to roll to the right,” the report said.

‘Critically Uncontrollable’The ground‑proximity warning system (GPWS) generated an aural “BANK ANGLE” warning when the bank angle reached 35 degrees. “This is an indication that the left IRU was operational and providing attitude data to the GPWS at this time,” the report said. The roll rate again was arrested by manual control input but only mo‑mentarily; the 737 continued to roll right and also began to pitch nose‑down.

The report said that the pilots likely had be‑come spatially disoriented. They did not follow standard procedures for recovering from a nose‑low unusual attitude. The procedure listed in the QRH requires the pilot flying to roll in the shortest direction to wings‑level before applying nose‑up elevator.

The aircraft was banked 100 degrees right and pitched 60 degrees nose‑down when one of the pilots pulled back on the control column, causing aerodynamic loading to increase to 2.0 g — that is, two times standard gravitational acceleration. The crew then began to roll the aircraft left at a rate of approximately 4 degrees per second. “Dur‑ing this roll, nose‑up elevator in excess of 2.0 g of force was commanded,” the report said. “Nose‑up elevator input continued, resulting in a 3.0‑g force … with 42 degrees of bank.”

DFDR data showed that the 737 descend‑ed from 35,000 ft to 9,920 ft in 75 seconds.

Aerodynamic loading reached 3.5 g, and airspeed increased to Mach 0.926 — 495 kt calibrated airspeed. “This g force and airspeed are beyond the design limitations of the aircraft,” the report said. U.S. certification standards re‑quire transport aircraft structures to withstand a maximum of 2.5 g at the design dive speed. The 737’s design dive speed is 400 kt.

The report said that the aircraft was in “a critically uncontrollable state” when the CVR recorded two thumps and the DFDR recorded a sudden and rapid change in aerodynamic load‑ing from 3.5 g to negative 2.8 g, which indicates that a significant structural failure had occurred.

“It is likely that the empennage sustained a significant structural failure during this sudden and rapid flight load reversal,” the report said.

The aircraft was descending through 12,000 ft when the structural failure occurred. The DFDR continued to record some parameters until the aircraft descended through about 9,000 ft, when the recording ceased. “The aircraft impacted the water at high speed and a steep descent angle and disintegrated,” the report said.

The aircraft was

banked 100 degrees

right and pitched 60

degrees nose-down

when one of the

pilots pulled back on

the control column.

the 737‑400 was produced from 1988 to 2000. It is 10 ft (3 m) longer than the 737‑300, has stronger landing gear and can ac‑commodate 146 to 168 passengers. The aircraft has CFM 56‑3B2 or

‑3C engines. Maximum operating speed is Mach 0.82, and maximum range is 2,808 nm (5,200 km). Maximum standard weights are 138,500 lb (62,823 kg) for takeoff and 121,000 lb (54,8865 kg) for landing.

Source: Jane’s All the World’s Aircraft

Boeing 737-400

© Frikkie Bekker/Jetphotos.net


cAuSAlfactors

No Training Provided“This accident resulted from a combination of factors, including the failure of the pilots to ad‑equately monitor the flight instruments, particu‑larly during the final two minutes of the flight,” the report said. “Preoccupation with a malfunc‑tion of the [IRS] diverted both pilots’ attention from the flight instruments and allowed the increasing descent and bank angle to go unno‑ticed. The pilots did not detect and appropriately arrest the descent soon enough to prevent loss of control.”

The report said that the pilots did not know the IRS well enough to troubleshoot the naviga‑tion problem promptly and correctly, and “their actions to rectify the problem resulted in a number of decision errors.”

AdamAir did not provide simulator training in correcting IRS malfunctions or in recovering from aircraft upsets. “In accordance with Civil Aviation Safety Regulations, Indonesian operators are required to provide training in emergency or

abnormal situations or procedures,” the report said. “However, at the time of the ac‑cident, the Indonesian regulations did not specifically require upset recovery to be included in their flight operations training.”

An engineering simulation conducted by Boeing indicated that recovery from the upset “with a minimum amount of overspeed” could have been made if the crew had leveled the wings before mak‑ing nose‑up elevator control input.

Entries in the aircraft’s technical log and maintenance

records during the three months preceding the ac‑cident included 154 recurring IRS faults — most involving the left IRU. “Line maintenance rectifi‑cation action was limited to re‑racking and swap‑ping IRU components, resetting circuit breakers and cleaning connections when the faults became repetitive,” the report said, noting that airline managers apparently were not aware of “the seri‑ousness of the unresolved and recurring defects” which warranted replacement of the IRU.

The report said that the airline had a work‑ing environment that tolerated continued opera‑tion of the aircraft with known IRS faults. “The fact that AdamAir was still having fleetwide recurring [IRS] defects 11 months after the ac‑cident (November 2007), clearly shows that the engineering supervision and oversight changes that were put in place after the accident, to re‑solve the recurring problems, were not effective,” the report said.2

Based on the findings of the investigation, NTSC made several recommendations to the Indonesian Directorate General of Civil Aviation (DGAC). Among the actions taken by the DGAC were the establishment of requirements for air operator certificate holders to provide instruc‑tion to pilots on IRS and autopilot failures in approved training devices, and to provide ground, simulator and flight training in upset recovery procedures. The DGAC also established naviga‑tion system training and qualification standards for maintenance engineers, and requirements to rectify a navigational system problem that is reported more than twice in a 30‑day period. ●

This article, except where noted, is based on NTSC Aircraft Accident Investigation Report KNKT/07.01/08.01.36:

“Boeing 737‑4Q8, PK‑KKW; Makassar Strait, Sulawesi, Republic of Indonesia; 1 January 2007.”

Notes

1. Tooley, Mike; Wyatt, David. Aircraft Communica‑tions and Navigation Systems: Principles, Operation and Maintenance. Oxford, England: Elsevier, 2007.

2. Media reports said that the Indonesian Ministry of Transportation revoked AdamAir’s air operator certificate on April 9, 2008, because the airline had failed to operate for 21 days.

© Phoenix International Holdings

An NTSB

representative

flushes debris off

a flight recorder

recovered from the

seabed by a remotely

operated vehicle.

FlightTRAINING

| 41www.FlightsaFety.org | AeRoSAfeTyworld | June 2008

“i think the pilot shortage is real and is only going to get worse,” said Paul Hinton, retired United Airlines pilot and man-

ager, and CEO of Saferjett, a keynote speaker at the World Aviation Train-ing Conference (WATS) in Orlando, Florida, U.S. in April, 2008. Hinton, also a retired Alteon executive, put his finger on the subject that was a major concern of aviation companies attend-ing WATS: how to handle the increas-ing need for quality pilots.

“I’m not too concerned about put-ting a low-time pilot in the right seat,” Hinton said. “I’m more concerned about moving that low-time pilot to the left seat.”

“Everything comes down to safety,” said Chris Schroeder, head of global flight operations for the International Air Transport Association (IATA), and the operations project lead of the IATA Training and Qualification Initiative (ITQI) in which Flight Safety Founda-tion is a partner with International Civil Aviation Organization (ICAO) participation.

Citing the ITQI mission state-ment, Schroeder said, “In times of high demand, there is a potential risk for a drop in training — and quality stan-dards. It is important to quantify and to balance the demand and the supply of licensed personnel on a regional as well as on a global level in all segments

of the aviation industry, with sustained quality and no compromise to safety and quality.”

ITQI, which has “secured resources and buy-in from all segments of the aviation industry,” intends to develop recommendations for meeting the train-ing needs for pilots, maintenance techni-cians and engineers with no compromise on safety and quality, Schroeder said. To that end, a number of immediate goals have been set. For the total project the “deliverables” include:

• Collect data and quantify the need and cost;

• Conduct a cost-benefit analysis;

U.S

. Nat

iona

l Aer

onau

tics a

nd S

pace

Adm

inist

ratio

n

Training for the Pilot ShortageFacing the needs of today and, even more, tomorrow.

By J.A. Donoghue | From orlAnDo

42 | Flight saFety Foundation | AeRoSAfeTyworld | June 2008

FlightTRAINING

• Conduct a global survey of industry competitiveness and attractiveness;

• Identify solutions to mitigate the shortage;

• Develop a proposal for renewed training and qualification process; and,

• Develop a communication strategy.

On the operations side, the project begins with a review of existing regula-tions and the development of global standards and best practices for:

• Multi-crew pilot license1 (MPL) implementation;

• Instructor qualification;

• Flight simulator qualification;

• Approval criteria for training providers;

• Pre-selection criteria for pilots;

• Type rating and recurrent train-ing; and,

• Transition into competency-based training.

Although the extent of the problem in the engineering and maintenance (E&M) side of the airline industry is difficult to track because of a compar-ative lack of data — the airlines’ need for pilots is easily linked to aircraft orders and forecasts, Schroeder said. Starting with a review of regulations and requirements, global standards and best practices will be developed for:

• Qualification requirements for E&M training syllabi and training devices;

• Recruitment and selection criteria;

• Training provider certification standards;

• E&M training requirements; and,

• Transition into competency-based training.

Although the task categories imply that there will be silos of concern with no interaction between them, he said that part of the plan includes a cross-feed of information between the seg-ments to ensure that the initiatives have a chance to work, an example being a connection between airline transport pilot (ATP) license standards, MPL and candidate-selection criteria.

Peter Wolfe, executive director of the Professional Aviation Board of Certification (PABC), said that a key problem in pilot training is the “lack of a pre-employment standard,” the high cost of bridging the gap between achieving a commercial pilot license (CPL) and gaining the experience need-ed for airline operations, and the lack of instructors, lured away from what had been time-building jobs by airlines with immediate needs.

“The most effective gap-closer is the MPL, but that will take time to build up,” Wolfe said. One of the problems, he said, is that there are no global stan-dards as “the gap-fillers have yet to be calibrated, coordinated.” Also troubling is the lack of consistent global testing standards for the CPL.

As part of the ITQI effort, the PABC is taking a leading role in developing such standards and certifications. Wolfe said the group plans to propose a global ATP examination that will unify all the existing paths to the cockpit, including MPL, through one standard.

ITQI will provide spin-off benefits, he said. “Lessons learned from the pilot shortage effort will have application in the other industry disciplines such as air traffic control, cabin, dispatchers and unmanned [aircraft system] operators.”

“MPL is a proactive and viable solu-tion” to the pilot shortage problem, key-noter Hinton said to start the conference.

Anna Kjaer, chief ground instructor, Center Air Pilot Academy, and Claus Gammelgaard, director of flight opera-tions, Sterling Airlines, enthusiastically supported MPL based on their experi-ence using an MPL program to train pilots for Sterling.

Calling MPL “the biggest over-haul of pilot training in more than 40 years,” Kjaer said MPL planning with Sterling began in 2004, resulting in a January 2007 start of the initial class of four students, who graduated in Sep-tember 2007. The first MPL graduates passed line checks and started flying as first officers in November. The second batch of MPL students, eight this time, graduated in March 2008, she said; her company has agreed to supply MPL-trained pilots to “numer-ous companies.”

The MPL training is not a shortcut, but “is a bit quicker” than traditional methods “because it is competency-based,” Kjaer said. Based on airline needs, the training reduces the amount of “de-learning” the trainees must endure when going through line qualifications. Other differences include producing pilots with increased company loyalty, higher instructor professionalism and better scheduling of simulator time.

Gammelgaard said Sterling does its own line training in-house, allowing a comparison between MPL and CPL line qualifying scores by using the same examiner. “Out of the first four MPL graduates, three were rated at a high stan-dard. They were released to the line after a bare minimum amount of training, and they are performing a lot better than stan-dard new hires,” Gammelgaard said. The second batch, while not at quite the same

| 43www.FlightsaFety.org | AeRoSAfeTyworld | June 2008

FlightTRAINING

high level as the first group, was doing well in their line checks, he said.

“MPL does work. There’s no magic, just apply-ing what we’ve learned about pilot training over 40 years of experience.”

The segment of the airline industry most impacted by the pilot shortage seems to be the regional airlines. Brian T. Wilson, a training captain for Atlantic Southeast Airlines (ASA), detailed how the average new-hire a decade ago had 8,000-plus flight hours total time, 1,200 flight hours multi-engine and a background in corporate, charter and military flying. This year, ASA’s high-time new-hire had 8,000 flight hours, but the low-time pilot had just 200 flight hours, with the average sitting at 600 flight hours total time, 120 flight hours multi-engine and a background in instruction and fast track programs. The immediate impact of this quality decrease for the airline was “additional simulator time and a higher washout rate,” Wilson said. Also increasing is the amount of flying new hires need before being released to line flying.

ASA looked at the shortcomings pilots were exhibiting, Wilson said, and the airline real-ized that the areas found lacking were those that previously had been supplied to pilots by the experience they got before arriving at ASA. “Our past assumption of professionalism and discipline is no longer valid,” he said. The same was true about basic flight management skills and the ability to apply theoretical knowledge to the real world.

This realization led the airline to develop “The Expertise Approach,” teaching in a structured way the kinds of information formerly gained through a series of “chance encounters.” Trying to “convey experience by design,” ASA will begin training its new pilots in pattern recognition, “experience as a memory of events, cues and information stored as patterns which are recognized in future events.” The process is being developed through interviews and panels with subject matter experts. Assist-ing in this process is the Team Performance Lab of Central Florida University and George Mason University, basing their work on psychologist Dr.

Gary Klein’s Recognition-Primed Deci-sion Model, Wilson said.

The problem of low pilot experience will continue to get worse, said Gregory Darrow, senior director, sales, at Pan Am International Flight Academy. The demand from airlines and flight depart-ments is so strong, and taking so many instructors, he said, “that training com-panies are paying for their high-quality students to get their instructor ratings only to lose them even before they get the rating.”

Minimum experience requirements at regional airlines range from 850 flight hours at Skywest to as low as 400 flight hours at American Eagle, “and all have exceptions for even lower time. The washout rate is as high as 40 percent, creating exceptional training costs.”

Larry Neal, Comair’s manager, training, said, “We’re pretty much all in the same situation out there, seeking qualified individuals.” In 2006, Comair was getting the first signs of a tightening labor market, and began adjusting training to ac-count for the lower experience levels, the training changed to address the experience level of each new class. A recent class had experience ranging from 600 to 200 flight hours, total time, with some pilots having to take a pre-employment jet transi-tion course to bridge the gap in their skills. As an indication of the level of skills Comair is experi-encing, Neal said, “our two biggest [skill] problems are visual approaches and no-flap landings.”

The full proceedings from WATS 2008 can be found at <www.halldale.com>. ●

Note

1. ICAO says the multi-crew pilot license “is a new license that allows a pilot to exercise the privileges of a copilot in a commercial air transportation on multi-crew airplanes. It provides the aviation com-munity with an opportunity to train pilots directly for copilot duties. It focuses on ab initio airline pilot training. MPL training and assessment is compe-tency-based and involves a multi-crew environment and threat-and-error management from the onset.” It also provides for greater use of flight simulation training and reduces the role of solo flying (ASW, 12/07, p. 38).

J.A. D

onog

hue

Schroeder

http://www.flightsafety.org/asw/dec07/asw_dec07_p38-41.pdf

© C

hris

Sore

nsen

Pho

togr

aphy


aviationmedicine

excessive loss of water from the human body can lead to dehydration, marked by fatigue and a deterioration of mental and physical performance that can have seri-

ous consequences for pilots.Pilots with health problems, including in-

testinal viruses or food poisoning, and pilots of small airplanes and helicopters without air con-ditioning and/or with large, heat-intensifying

windshields — especially those operating on hot days — may be most susceptible to the ill effects of dehydration. However, pilots of air carrier aircraft are not immune.

For example, the first officer of a Boeing 737-700 said, in a report submitted to the U.S. National Aeronautics and Space Admin-istration (NASA) Aviation Safety Reporting System (ASRS), that she had become ill in July

Dry and HighDehydration causes an insidious degradation of

pilot performance that must not be lightly regarded.

BY LINDA WERFELMAN


aviationmedicine

2004 during a flight from Nashville, Tennes-see, U.S.1

In her report, the first officer said that the night before the flight, she had been sick with nausea, vomiting and diarrhea, which she as-sumed to be associated with food poisoning, but that she felt “physically fit to fly” when she reported for duty. During cruise, she experienced repeated bouts of nausea and complied with the captain’s eventual instructions to leave the cockpit to rest in the cabin while he diverted the airplane to an en route airport for landing. Emergency medical services personnel met the airplane, ex-amined the first officer and determined that her nausea was not a sign of serious illness and her lingering weakness was caused by dehydration.

Dehydration occurs when water consumption is inadequate or when the human body loses an excessive amount of water — through heavy per-spiration, exposure to hot weather, fever, vomit-ing or diarrhea, use of diuretics to increase urine excretion, and some diseases. The low humidity in pressurized air carrier aircraft also is a con-tributing factor. In addition, alcoholic beverages

— such as those consumed a day before a flight — and caffeine have diuretic effects.

Water accounts for about two-thirds of body weight and is an essential component of the hu-man body, needed for replicating cells, moving nutrients and waste products, and regulating body temperature. The kidneys excrete between 1.0 pt (0.5 L) and several gallons (1.0 gal equals 3.8 L) daily — a typical amount is 3.0 to 4.0 pt (1.4 to 1.9 L); in addition, varying amounts of water are lost to perspiration.

To stay healthy, an individual must consume enough water to offset these losses. For years, typical recommendations have called for drink-ing 2.0 qt (1.9 L) of water daily, although some medical specialists question the rationale for that recommendation (see “Recommendations for Preventing Dehydration”).

An editorial in the April 2008 Journal of the American Society of Nephrology said that the ori-gin of the recommendation is unknown but that different studies have made a variety of claims about the supposed benefits of drinking water,

ranging from improv-ing kidney function and aiding weight loss to preventing headache.2

“There is no clear evidence of ben-efit from drinking increased amounts of water,” the editorial said. “We concede there is also no clear evidence of lack of benefit. In fact, there is simply a lack of evidence in general.”

Nevertheless, aeromedical special-ists say that failing to drink an adequate amount of water can result in an increased susceptibility to fatigue.

For example, the U.S. National Transportation Safety Board (NTSB) discussed dehydration and fatigue in its final report on the crash of a Bell 206B during a sightseeing flight on the Hawaiian island of Kauai on Sept. 24, 2004. The pilot and all four passengers were killed in the crash, which also destroyed the helicopter. The NTSB report said that the operator’s schedule included no breaks for pilots, who typically ate lunch in their helicopters and remained at the controls for up to eight hours, and that the staging area had no restroom facilities.3

“The lack of scheduled breaks, the short turn-around times between flights and the unavail-ability of private restroom facilities probably discouraged consumption of food and liquids during the workday because there was little

the following are recommendations for preventing dehydration and other heat-related problems:1

• Drinkabout2.0qt(1.9L)ofwaterevery24hours,althoughtheexactamountvarieswidely.Drinkbeforeyoubecomethirsty,anddrinkfromacontainerthatallowsyoutomea-suredailywaterconsumption;

• Limitconsumptionofalcoholandcaffeine.Botharediuretics,whichincreasetheexcretionofurine;

• Monitorworkandrecreationalactivities,andstopwhatyouaredo-ingifyoufeellight-headedordizzy.Exercisecanresultinwaterlossthatisdifficulttoovercomequickly;

• Beawareofyourphysicalcondition,especiallyifyouhaverecentlybeenill;and,

• Rememberthatyourbody’sadjust-menttoamajorchangeinweather,suchasthesuddenonsetofhotweather,cantakeonetotwoweeks.

—LW

Reference

1. Shaw,RogersV.III.“DehydrationandthePilot.”The Federal Air Surgeon’s Medical Bulletin(Spring2000):10.

Recommendations for Preventing Dehydration


aviationmedicine

opportunity to go to the bathroom,” the report said. “This increased the risk of dehydration and other physiological problems, which could have degraded performance.”

As a result of its investigation, the NTSB issued nine safety recommendations, including two involving development and enforcement of operational practices to provide for rest breaks for the pilots of sightseeing helicopters.

Quay Snyder, president and CEO of Vir-tual Flight Surgeons, an aeromedical consult-ing group, said that dehydration is “a definite contributing factor” not only to fatigue but also to the formation of kidney stones — stonelike masses that form in the urinary tract and can cause severe pain. Medical specialists attribute their formation to a concentration of mineral salts in the urine or to the absence from the urine of substances that inhibit formation of the stones.

Although smaller kidney stones may be asymptomatic, larger ones can cause abdominal pain, nausea and vomiting, fever and blood in the urine. Recurrent kidney stones can result in loss of medical certification.

Formation of kidney stones generally can be prevented simply by drinking enough water, Snyder said.

He said that some flight crewmembers might have intentionally reduced their fluid intake since the terrorist attacks of Sept. 11, 2001 — and the subsequent adoption of an elaborate set

of requirements for pilots who leave the flight deck, even for a visit to a lavatory.

“It’s a bad idea for health reasons,” Snyder said, noting “at least a perception” that more pilots have been calling his office about kidney stones in recent years than in the period before September 2001. “But it’s perhaps a convenient idea for the flight crew.”

Snyder and other aeromedical specialists recommend that pilots drink fluids — but not caffeinated fluids — “on a regular basis” throughout their flights. Although some specify a precise amount of liquid that should be con-sumed, Snyder does not. Instead, he says that it should be enough to keep their urine clear and light in color. Sometimes the amount may be less than 2 qt; other times it may be more.

“I believe in what I’m saying,” Snyder said. “As a glider pilot, I consume 170 to 200 oz [5 to 6 L].”

Similar quantities are not necessary for air carrier pilots, who do not operate in the hot, sunny environments typical of gliders, he said.

Similar advice comes from Rogers V. Shaw III, team coordinator of the Airman Education Program of the U.S. Federal Aviation Admin-istration Civil Aerospace Medical Institute Aero-space Medical Education Division, who said that a primary consideration is for pilots to continu-ally be aware of their physical condition.4

“Most folks will become thirsty with a 1.5-quart [1.4-liter] deficit, or a loss of 2 percent of total body weight,” Shaw said. “This level of dehydration triggers the thirst mechanism. The problem, though, is that the thirst mechanism arrives too late and is turned off too easily. A small amount of fluid in the mouth will turn this mechanism off, and the replacement of needed body fluid [will be] delayed.”

Medical authorities say that symptoms ac-cumulate as the body continues to lose water (Table 1). After a deficit of about 3.0 qt (2.8 L), symptoms may include fatigue, nausea and emotional instability.

Transport Canada (TC) calls this “a very dangerous level for pilots, as this is where your faculties start to become affected, but you may not be aware of the deteriorated performance.”

Symptoms of Dehydration

Amount of Water Lost Symptoms

1.5L(1.6qt) Thirst

3.0L(3.2qt) Sluggishness,fatigue,nausea,emotionalinstability

4.0L(4.2qt) Clumsiness,headache,elevatedbodytemperature,elevatedpulse,elevatedrespiratoryrate

5.0L(5.3qt) Dizziness,slurredspeech,weakness,confusion

6.0L(6.3qt) Delirium,swollentongue,circulatoryproblems,decreasedbloodvolume,kidneyfailure

9.0L(9.5qt) Inabilitytoswallow,painfulurination,crackedskin

12.0L(12.7qt) Imminentdeath

Source:Maidment,Graeme.“Chapter15:ThermalPhysiology.”InAviation Medicine,ThirdEdition,editedbyErnsting,John;Nicholson,AnthonyN.;Rainford,DavidJ.Oxford,England:ButterworthHeinemann,1999.

Table 1


aviationmedicine

One TC publication described experiments involving U.S. Army helicopter pilots and said that the pilots’ self-reporting of problems related to dehydration was inaccurate, even at the early stages of dehydration, and pilots who felt no adverse effects had “clear, objective difficulty with cognitive tests.”5

A 4.0-qt (3.8-L) deficit can result in clumsi-ness, headache and elevated temperature. After loss of a little more than 12.7 qt (12.0 L), death is imminent.6

Water vs. Sports DrinksUnder normal circumstances, medical authori-ties suggest that water is usually the best drink for a pilot to consume, although there is a place for rehydration drinks, including so-called sports drinks, that have been formulated not only to replenish lost fluids but also to restore the proper concentration of electrolytes — dis-solved minerals such as sodium and potassium

— in the blood. The electrolytes are electrically charged molecules that are key to many essen-tial bodily functions.

“I don’t believe there is any harm in sports drinks, et cetera, as long as individuals don’t drink excessive quantities, but they are of little additional benefit for a pilot who has a normal, balanced diet,” said Dr. Anthony Evans, chief of the International Civil Aviation Organization Aviation Medicine Section.

Rehydration drinks may be required if pilots undergo significant or prolonged heat stress, he said.

Heat-Related IllnessesIn some situations, such as prolonged exposure to very hot temperatures in a cockpit that is not air conditioned, dehydration can progress to a heat-related illness, such as heat cramps — characterized by muscle cramps, profuse sweat-ing, fatigue and thirst.7,8 Treatment typically includes drinking a sports drink or other fluid containing electrolytes and moving to a cooler spot.

Without such treatment, heat cramps can develop into heat exhaustion, with symptoms

including headache, dizziness, nausea and dark urine. Without treatment — again, drinking a fluid containing electrolytes and moving to a cooler spot — the result can be heatstroke, a life-threatening condition in which the body temperature climbs to 104 degrees F (40 degrees C) or higher. Heatstroke can lead to shock or organ damage.

Treatment for heatstroke is more aggressive than treatment for less serious forms of heat-related illness and may include immersion in cold water or wrapping the victim in a cooling blanket and placing ice packs at the neck and other areas of the body. The goal is to quickly reduce the body temperature to normal in order to limit damage to the brain and other vital organs. ●

notes

1. NASA ASRS. Report no. 624470. July 2004.

2. Negoianu, Dan; Goldfarb, Stanley. “Editorial: Just Add Water.” Journal of the American Society of Nephrology Volume 19 (2008). <www.asn-online.org/press/pdf/2008-Media/Water%20Study.pdf>.

3. NTSB. Weather Encounter and Subsequent Collision Into Terrain, Bali Hai Helicopter Tours Inc. Bell 206B, N116849, Kalaheo, Hawaii. Sept. 24, 2004. The NTSB said that the probable cause of the accident was “the pilot’s decision to continue flight under visual flight rules into an area of turbulent, reduced-visibility weather conditions, which resulted in the pilot’s spatial disorientation and loss of control of the helicopter.” Among the contributing factors was “the operator’s pilot-scheduling practices that likely had an adverse impact on pilot decision making and performance.”

4. Shaw, Rogers V. III. Dehydration and the Pilot. <www.faa.gov/pilots/training/airman_education/topics_of_interest/dehydration/index.cfm>.

5. TC. “I Need a Drink.” Aviation Safety Vortex, March 2002.

6. Maidment, Graeme. Chapter 15, “Thermal Physiology.” In Aviation Medicine, Third Edition, edited by Ernsting, John; Nicholson, Anthony N.; Rainford, David J. Oxford, England: Butterworth Heinemann, 1999.

7. Shaw.

8. Mayo Clinic. Heatstroke. <www.mayoclinic.com/health/heat-stroke/DS01025/DSECTION=3>.


DAtAlink

a favorable trend ContinuesU.S. FARs Part 121 accident rates decreased in 2007 for the second year in a row.

BY RICK DARBY

d espite recent concerns in the U.S. Congress over the safety of U.S. air-lines, and a flurry of Federal Avia-tion Administration audits to assuage

those concerns, the preliminary accident statistics for 2007 from the National Trans-portation Safety Board suggest that air travel in the United States is no less safe than in recent years, and in most respects, the long-term trend improved.1

U.S. air carriers operating under Federal Aviation Regulations (FARs) Part 121, Operating Requirements: Domestic, Flag, and Supplemental Operations, were involved in 0.009 fatal acci-dents per 100,000 departures in 2007, counting both scheduled and nonscheduled service. In a statistical oddity, that was exactly half the 2006 rate, 0.018, and exactly one-third the 2005 rate, 0.027.

All accidents, fatal and nonfatal, in that operational category occurred at a rate of

0.239 per 100,000 departures, a 22 percent decline from 0.305 in 2006 and the lowest rate in the 1998–2007 period. The one 2007 fatal accident and its one fatality — a maintenance technician — compared with annual averages of 1.8 and 21.6, respectively, in the previous five years.2

U.S. air carriers operating under FARs Part 135, Operating Requirements: Commuter and On Demand Operations, showed little change in commuter accident rates, while on-demand operation accident rates increased. For both, the rates were below the average for the previous nine years.

The overall statistics (Table 1) show a familiar pattern. Scheduled air carriers operat-ing under Part 121 (aircraft with more than 10 passenger seats) had a rate of 0.224 accidents per 100,000 departures, 57 percent less than the 0.526 for commuter operators under Part 135. There were no fatal accidents in Part 121

Scheduled air carriers

operating under Part

121 had a rate of

0.224 accidents per

100,000 departures,

57 percent less

than the 0.526 for

commuter operators

under Part 135.


DAtAlink

Accidents, Fatalities and Rates, U.S. Air Carriers, 2007

Accidents Fatalities

Flight hours Departures

Accidents per 100,000 Flight Hours

Accidents per 100,000 Departures

All Fatal Total Aboard All Fatal All Fatal

U.S. air carriers operating under FARs Part 121

Scheduled 24 0 0 0 18,700,000 10,720,000 0.128 — 0.224 —

Nonscheduled 2 1 1 1 605,000 180,000 0.331 0.165 1.111 —

U.S. air carriers operating under FARs Part 135

Commuter 3 0 0 0 302,000 570,000 0.993 — 0.526 —

On-demand 62 14 43 43 3,668,000 — 1.69 0.38 — —

U.S. general aviation 1,631 284 491 486 23,835,000 — 6.84 1.19 — —

Other accidents in the U.S.

Non-U.S.-registered 11 1 3 3

Unregistered aircraft 14 6 7 7

FARs = U.S. Federal Aviation Regulations

Notes: All data are preliminary.

Departure information for Part 135 on-demand operations is not available. U.S. air carriers operating under Part 135 previously called scheduled and nonscheduled are now identified as commuter and on-demand, respectively.

Source: U.S. National Transportation Safety Board

Table 1

Accidents, Fatalities and Rates, U.S. Air Carriers, FARs Part 121, Scheduled Operations, 1998–2007

Year


Flight Hours Miles Flown Departures


Accidents per 1,000,000 Miles Flown


All Fatal Total Aboard All Fatal All Fatal All Fatal

1998 41 1 1 0 15,921,447 6,343,690,000 10,535,196 0.258 0.006 0.0065 0.0002 0.389 0.009

1999 40 2 12 11 16,693,365 6,689,327,000 10,860,692 0.24 0.012 0.006 0.0003 0.368 0.018

2000 49 2 89 89 17,478,519 7,152,260,000 11,053,826 0.28 0.011 0.0069 0.0003 0.443 0.018

2001 41 6 531 525 17,157,858 6,994,939,000 10,632,880 0.216 0.012 0.0053 0.0003 0.348 0.019

2002 34 0 0 0 16,718,781 6,927,954,000 10,276,107 0.203 — 0.0049 — 0.331 —

2003 51 2 22 21 16,887,756 7,015,935,000 10,227,924 0.302 0.012 0.0073 0.0003 0.499 0.02

2004 23 1 13 13 18,184,016 7,604,248,000 10,782,989 0.126 0.005 0.003 0.0001 0.213 0.009

2005 33 3 22 20 18,712,191 7,843,717,000 10,910,460 0.176 0.016 0.0042 0.0004 0.302 0.027

2006 26 2 50 49 18,647,896 7,851,864,000 10,627,481 0.139 0.011 0.0033 0.0003 0.245 0.019

2007 24 0 0 0 18,700,000 7,860,000,000 10,720,000 0.128 — 0.0031 — 0.224 —


Notes: The 2007 data are preliminary.

For 2001, the totals for accidents and fatalities include those resulting from the terrorist attacks of Sept. 11. Only on-board fatalities are counted. The accident rate computations do not include the Sept. 11 attacks.


Table 2


DAtAlink

Accidents, Fatalities and Rates, U.S. Air Carriers, FARs Part 135, Commuter Operations, 1998–2007

Year

Accidents FatalitiesFlight Hours

Miles Flown Departures


Accidents per 1,000,000 Miles Flown


All Fatal Total Aboard All Fatal All Fatal All Fatal

1998 8 0 0 0 353,670 50,773,000 707,071 2.262 — 0.1576 — 1.131 —

1999 13 5 12 12 342,731 52,403,000 672,278 3.793 1.459 0.2481 0.0954 1.934 0.744

2000 12 1 5 5 369,535 44,943,000 603,659 3.247 0.271 0.2670 0.0223 1.988 0.166

2001 7 2 13 13 300,432 43,099,000 558,052 2.330 0.666 0.1624 0.0464 1.254 0.358

2002 7 0 0 0 273,559 41,633,000 513,452 2.559 — 0.1681 — 1.363 —

2003 2 1 2 2 319,206 47,404,000 572,260 0.627 0.313 0.0422 0.0211 0.349 0.175

2004 4 0 0 0 302,218 46,809,000 538,077 1.324 — 0.0855 — 0.743 —

2005 6 0 0 0 299,775 45,721,000 527,267 2.002 — 0.1312 — 1.138 —

2006 3 1 2 2 301,495 46,503,000 568,464 0.995 0.332 0.0645 0.0215 0.528 0.176

2007 3 0 0 0 302,000 46,600,000 570,000 0.993 — 0.0644 — 0.526 —



Based on a February 2002 U.S. Federal Aviation Administration legal interpretation provided to the National Transportation Safety Board, any FARs Part 135 operation conducted with no revenue passengers aboard is considered a nonscheduled flight operation. This interpretation has been applied to accidents beginning in the year 2002. It has not been retroactively applied to accidents during the period 1998–2001.

U.S. air carriers operating under Part 135 previously called scheduled and nonscheduled are now identified as commuter and on-demand, respectively.


Table 4

scheduled operations. In Part 121 nonscheduled operations, the one fatal accident involved a maintenance technician ingested into an engine while working on a Boeing 737.

Table 2 (p. 49) shows accidents, fatalities and rates for Part 121 scheduled operations from 1998 through 2007.3 Accidents per 100,000 departures declined 9 percent, from 0.245 to 0.224, the second lowest rate in the 10-year period. Compared with 2003, which had the highest rate during the period at 0.499, the decrease was 55 percent. Only 2004 had a lower rate, 0.213. The 2007 rate was 36 percent lower than the average for the previ-ous nine years.

The number of accidents, 24, was also the second lowest in the period. Last year was one of two in the past 10 years with no fatal accidents.

Nonscheduled operations comprise a small portion of Part 121 flights — less than 2 per-cent in 2007. Their accident rate was 1.111 per 100,000 departures, about five times the rate

Passenger Injuries and Injury Rates, U.S. Air Carriers, FARs Part 121, 1998–2007

Year Passenger Fatalities

Passenger Serious Injuries

Total Passenger Enplanements

(millions)

Million Passenger Enplanements per Passenger Fatality

1998 0 12 650 No fatalities

1999 10 46 676 67.6

2000 83 11 701 8.4

2001 483 7 629 1.3


2003 19 10 654 34.4

2004 11 3 711 64.6

2005 18 2 743 41.3

2006 47 4 747 15.9




For 2001, the total for passenger fatalities includes those resulting from the terrorist attacks of Sept. 11.

Aircraft with 10 or more seats in scheduled passenger service are operated under Part 121.


Table 3


DAtAlink

Accidents, Fatalities and Rates, U.S. Air Carriers, FARs Part 135, On-Demand Operations, 1998–2007

Year


Flight Hours


All Fatal Total Aboard All Fatal

1998 77 17 45 41 3,802,000 2.03 0.45

1999 74 12 38 38 3,204,000 2.31 0.37

2000 80 22 71 68 3,930,000 2.04 0.56

2001 72 18 60 59 2,997,000 2.40 0.60

2002 60 18 35 35 2,911,000 2.06 0.62

2003 73 18 42 40 2,927,000 2.49 0.61

2004 66 23 64 63 3,238,000 2.04 0.71

2005 65 11 18 16 3,815,000 1.70 0.29

2006 53 10 16 16 3,742,000 1.42 0.27

2007 62 14 43 43 3,668,000 1.69 0.38



In 2002, the U.S. Federal Aviation Administration (FAA) changed its estimate of on-demand activity. The revision was retroactively applied to the years 1992 to present. In 2003, the FAA again revised flight activity estimates for 1999–2002.

U.S. air carriers operating under Part 135 previously called scheduled and nonscheduled are now identified as commuter and on-demand, respectively. Part 135 on-demand operations encompass charters, air taxis, air tours and medical service when a patient is aboard.


Table 5

for scheduled operations. The nonscheduled operations included the one fatal accident, the first since 2004 and one of five in the 10-year period.

There were three serious passenger injuries for all Part 121 operations in 2007, compared with an annual average of 11.8 in the 1998–2006 period (Table 3).

Commuter operations had roughly the same accident rate in 2007 as in 2006 (Table 4). The rate of 0.526 per 100,000 departures was 2.3 times that for Part 121 scheduled operations. There were no fatal accidents in the Part 135 commuter category.

Part 135 on-demand operations (Table 5) resulted in 1.69 accidents per 100,000 flight hours, up from 1.42 in 2006.4 The 2007 rate was, however, lower than the average of 2.05 for 1998 through 2006. There were 43 on-board fatalities, compared with 16 in each of the two previous years. The fatal accident rate also rose in 2007 to 0.38 from 0.27 the previous year; that, too, was lower than the average of 0.50 for the previous nine years.

The NTSB classifies accidents as major, seri-ous, injury and damage.5 In 2007, there were no major accidents for the first time since 1998. There were two serious accidents, the same number as in 2006; 14 injury accidents, double the number in 2006; and 10 damage accidents, compared with 22 in 2006. ●

Notes

1. The data are available on the NTSB Web site at <www.ntsb.gov/aviation/Stats.htm>.

2. Although most data in this article are concerned with the 1998–2007 period, ASW has calculated the average of fatalities beginning in 2002 because the NTSB includes the Sept. 11, 2001, terrorist acts in the accident and fatality totals for that year.

3. The 2006 preliminary data (ASW, 7/07, p. 50) have since been slightly adjusted. Those for 2007 are also subject to possible revision.

4. Numbers of departures for Part 135 on-demand operations are not available.

5. A major accident is one in which any of three condi-tions is met: (1) a Part 121 aircraft was destroyed, or (2) there were multiple fatalities or (3) there was one fatality and a Part 121 aircraft was substantially damaged.

A serious accident is one in which at least one of two conditions is met: (1) there was one fatality without substantial damage to a Part 121 aircraft, or (2) there was at least one serious injury and a Part 121 aircraft was substantially damaged.

An injury accident is a nonfatal accident with at least one serious injury and without substantial damage to a Part 121 aircraft.

A damage accident is one in which no one was killed or seriously injured, but in which any aircraft was substantially damaged.

http://www.flightsafety.org/asw/july07/asw_july07_p50-52.pdf

52 | flight safety foundation | AEROSAfEtyWorld | June 2008

InfOscan

Federal AviationAdministration

Animations provided byVideo Instructions forPresenter – Click here

Maintenance HumanFactors PresentationSystem

Prepared byAviation Safety OrganizationFlight Standards Service

Maintenance human factors on dVdCustomizable presentation modules include videos,

animations and a touch of humor to convey insights.

ELECTRONIC MEDIA

the fAA Maintenance Human factors Presentation System (MHfPS)Johnson, W.B.; ciaccio, J.M. u.s. federal aviation administration (faa) flight standards service and chief scientific and technical advisor Program. 2007. available on dVd by e-mail request to several organizations.*

the Maintenance Human Factors Presen-tation System (MHFPS), distributed on DVD, serves as a teaching support tool for

applied human factors training. While designed for maintenance, many of the messages are the generic and applicable to all aviation workers, from ramp personnel to flight crews.

The MHFPS comprises over 160 Microsoft PowerPoint slides. Embedded in the slides are 10 FAA video clips and 40 animations that were produced by Lufthansa Technical Training. The PowerPoint content can be organized and edited to meet user requirements. Most of the slides include additional presentation instructions in notes. The system is designed for users at all levels of human factors expertise.

Units of the MHFPS address topics includ-ing the history of human factors; human factors defined; the people-environment-actions-resources (PEAR) model for understanding and applying human factors principles; fatigue, error and event investigation; and sources of addition-al information. The MHFPS offers seven topical presentations or a blend of topics to meet short, medium and long time slots.

Examples of videos include “Counting Sleep” and “Human Factors Spectacles.” The first video depicts a discussion about “how many hours did you sleep last night?” It uses light-hearted conversation to deliver the serious message that people typically overestimate sleep obtained and, too often, do not get enough. It suggests a 10-day program to count hours of sleep.

The “Spectacles” video suggests that all aviation workers must look at work and life situations with an eye to human factors. The message is delivered as the presenter views the audience and herself both with and without eyeglasses as a metaphor for human factors perspectives. In both videos, the messages are clear and memorable, designed with a bit of humor for easy consumption.

The MHFPS can be customized without restriction, permitting presenters to make the product a better fit for their own audiences. Addi-tional slides can be added if the trainer chooses.

Also included on the MHFPS DVD are the FAA 2006 Operator’s Manual for Human Factors in Maintenance and the FAA 2007 Operator’s Manual for Human Factors in Airport Services.

The MHFPS is distributed at no cost by the Civil Aerospace Medical Institute in the United States, the Singapore Institute of Aerospace Engineers in the Asia-Pacific region and the International Federation of Airworthiness in the United Kingdom and Europe. Requests for the DVD should go to the organization that is clos-est geographically, as listed under “Sources.”

| 53WWW.flightsafety.org | AEROSAfEtyWorld | June 2008

InfOscan

CAP 722

Unmanned Aircraft System Operations in UK Airspace – Guidance

www.caa.co.uk

Directorate of Airspace Policy

Drug Usage in Pilots Involved in Aviation Accidents Compared With Drug Usage in the General Population: From 1990 to 2005

Sabra R. BotchRobert D. JohnsonCivil Aerospace Medical InstituteOklahoma City, OK 73125

April 2008

Final Report

DOT/FAA/AM-08/10Office of Aerospace MedicineWashington, DC 20591

REPORTS

Unmanned Aircraft System Operations in UK Airspace — Guidanceu.K. civil aviation authority, directorate of airspace Policy. caP 722. april 28, 2008. 92 pp. figures, tables, references. available via the internet at <www.caa.co.uk/application.aspx?catid=33&pagetype=65&appid=11&mode=detail&id=415> or from the stationery office.**

this first revision of CAP 722 since November 2004 includes “major changes” on legal, certi-fication, communication frequency spectrum

and security issues. “With an ever-increasing number of manufacturers and operators, it is vital that the regulations keep pace with UAS [un-manned aircraft system] developments, without losing sight of the safety issues involved in the si-multaneous operation of manned and unmanned aircraft,” the document says.

The safety requirements that have to be met for UAS operation in the United Kingdom in-clude both operational standards and airworthi-ness. CAP 722 intends “to assist those who are involved in the development of UAS to identify the route to certification.”

Although UAS flights are currently limited to segregated airspace, “the ultimate aim is to develop a regulatory framework which will en-able the full integration of UAS activities with manned aircraft operations throughout U.K. airspace,” the publication says.

The traditional “see and avoid” principle for manned flight under visual flight rules is being adapted to “sense and avoid” for UAS. “Any proposed function must demonstrate at least equivalence with manned aircraft safety stan-dards and, where these standards exist, the UAS must comply with the rules and obligations that apply to manned aircraft, including those ap-plicable to separation and collision avoidance,” the publication says.

The radar surveillance policy is that “UAS shall be able to interact with all other airspace users, regardless of the airspace or UAV [un-manned aerial vehicle] flight profile, in a manner that is transparent to all other airspace users and air navigation service providers, when compared to manned aircraft,” the publication says. “UAVs shall be interoperable with all surveillance

systems without any additional workload for aircraft controllers, surveillance systems, manned aircraft pilots or other UAV pilots. UAVs shall carry suitable equipment so as to be able to in-teract with aircraft equipped with mandated air-borne collision avoidance systems such as TCAS [traffic-alert and collision avoidance system] II. Where a UAV employs a collision-avoidance system with reactive logic, any maneuver result-ing from a perceived threat from another aircraft shall not reduce the effectiveness of a TCAS II resolution advisory maneuver from that aircraft.”

For UASs with an aircraft component of greater than 150 kg (331 lb), airworthiness design and production standards will in general be the responsibility of the European Aviation Safety Agency. “Continuing airworthiness re-quirements, including maintenance, appropriate to each type of UAS issued with an airworthi-ness certificate will be in accordance with the requirements that currently apply to manned aircraft,” the publication says.

Drug Usage in Pilots Involved in Aviation Accidents Compared With Drug Usage in the General Population: from 1990 to 2005Botch, sabra r.; Johnson, robert d. u.s. federal aviation administration (faa) office of aerospace Medicine. dot/faa/aM-08/10. final report. april 2008. 11 pp. table, references. available via the internet at <www.faa.gov/library/reports/medical/oamtechreports/2000s/media/200810.pdf> or from the national technical information service.***

researchers at the FAA Civil Aerospace Medical Institute (CAMI) compared usage of illegal drugs and abuse-prone prescrip-

tion medications among pilots involved in U.S. civil aviation accidents from 1990 to 2005 with that of the general population.

CAMI analyzes toxicological specimens collected from pilots involved in accidents. The study considered specimens from 5,321 pilots, 97 percent of whom were male. Of the total, 90 per-cent of specimens were from autopsies. The study examined accident pilot use of controlled sub-stances such as marijuana, methamphetamine, cocaine and MDMA — known as “ecstasy.” It also looked at use of anti-anxiety drugs, sedatives and painkillers.


InfOscan

Drug usage among the accident pilots was compared with data from the general popula-tion obtained from various federal agencies. The report did not differentiate between pilots in general aviation and commercial air transport.

“The occurrence of illicit and legal drugs in pilots involved in civil aviation accidents during the examined time period reflected that seen in the non-flying public,” the report says. “There was a slight difference in the average age of the user, with pilots being slightly older on average than other drug users in the United States.”

Among the pilots involved in aviation accidents, 467, or 9 percent, tested positive for either illicit drugs or commonly abused prescription drugs.

“As with the general population, the use of marijuana by pilots was far more prevalent than the use of all other illegal and prescription drugs,” the report says. “In fact, marijuana was seen two times as often as the next most-used compound. Following marijuana use, the most often-used drugs were found to be opiates, ben-zodiazepines and cocaine.”

Development of an Aeromedical Scientific Information System for Aviation SafetyPeterman, connie l.; rogers, Paul B.; Véronneau, stephen J.h.; Whinnery, James e. u.s. federal aviation administration (faa) office of aerospace Medicine. dot/faa/aM-08/1. final report. January 2008. 21 pp. figures, tables, references, appendixes. available via the internet at <www.faa.gov/library/reports/medical/oamtechreports/2000s/media/200801.pdf > or from the national technical information service.***

the Bioinformatics Research Team at the FAA Civil Aerospace Medical Institute (CAMI) created a scientific information

system (SIS) to deal with the increasingly large government datasets on aviation incidents and accidents, as well as pilot medical certifications. “A knowledge discovery process was developed to consolidate different aviation data sources into a single dataset with a format more condu-cive to statistical analysis,” the report says.

“One benefit of our SIS is that it will support epidemiological researchers in aviation safety studies who are not familiar with the underlying process of the dataflow, collection and storage.

This system will support studies that examine the aviation safety and aeromedical aspects of certify-ing pilots with various pathological conditions. Finding patterns in the distribution of various pathologies in the mining of the electronic exam records of the U.S. pilot population is essential in any aviation epidemiological study.”

The newly developed SIS synthesizes data from three major sources: the National Trans-portation Safety Board Aviation Accident Database, the FAA Accident/Incident Data System and the Airmen Registry pilot certificate component, plus several specialized aviation safety databases developed at CAMI.

The SIS turned up a surprise. The report says, “Examination of the counts of active airmen by year revealed an anomaly in the numbers of electronic medical certificates issued during the years 1994 through 1999. Roughly 50 percent of the electronic medical exam records in this time period omitted the medical class issued for the certificate. This caused a large dip in the count of active airmen for this time period.”

Correcting the data resulted in the inclu-sion of an additional 1.4 million exam records of more than 425,000 pilots. “This inclusion of medical records, corrected solely by the de-termination of their correct historical medical class, had the effect of discovering additional accident records,” the report says.

Analysis, Causality and Proof in Safety InvestigationsWalker, Michael B. australian transport safety Bureau (atsB). ar-2007-053. March 11, 2008. 106 pp. figures, tables, appendixes. available via the internet at <www.atsb.gov.au/publications/2008/ar2007053.aspx> or from atsB.****

determining, as far as possible, what happened in an accident or incident is only the first part of an investigation if it is to be useful in

avoiding similar events. This report, an overview of the ATSB’s newly developed investigation analy-sis framework, says that other aims are to

• “Determine the contributing safety factors (that is, how and why it happened);

• “Determine the safety issues that should be addressed; [and,]


InfOscan

• “Encourage or facilitate safety action by relevant organizations to address the iden-tified safety issues.”

The report’s aims, it says, include providing “relevant background information concerning the purpose of safety investigations, the role of analysis, and an overview of the development and components of the ATSB analysis framework”; dis-cussing “the new safety analysis terminology being used by the ATSB (such as ‘contributing safety factor’ and ‘safety issue’)”; providing “an overview of the ATSB analysis process” and “background information on concepts such as contribution (or causation) and ‘standard of proof,’ and how these concepts have been addressed in the ATSB analysis framework.” Finally, the report “outlines concerns that have been expressed regarding the ATSB framework and similar approaches, and the ATSB consideration of these concerns.”

The report explains why there had been a need for a new analysis framework: “Despite its importance, complexity and reliance on investigators’ judgments, analysis has been a neglected area in terms of standards, guidance and training of investigators in most organiza-tions that conduct safety investigations. Many investigators … seem to conduct analysis activi-ties primarily using experience and intuition which is not based on, or guided by, a structured process. It also appears that much of the analysis is typically conducted while the investigation report is being written. As a result, the writing process can become inefficient, supporting ar-guments for findings may be weak or not clearly presented, and important factors can be missed.”

To avoid such problems, the ATSB investiga-tion analysis framework includes these elements:

• “Standardized terminology and definitions for analysis-related terms. This includes defi-nitions for ‘risk,’ ‘hazard’ and ‘safety,’ as well as terms to describe events and conditions that increase safety risk (‘safety factors’), the events and conditions that contributed to the development of an occurrence (‘contribut-ing safety factors’) and the conditions that

will have an influence on future safety unless addressed (‘safety issues’);

• “An accident development model. The ATSB ‘investigation analysis model’ incorporates an adaptation of the [James] Reason model of organizational accidents, and involves a set of functional questions to help identify potential safety factors”;

• A defined process or workflow for con-ducting analysis activities. The process is divided into five main components: pre-liminary analysis, safety factors analysis, risk analysis, safety action development and analysis review”; [and,]

• “A set of tools in [the] Safety Investigation Information Management System [a new occurrence database] to guide and docu-ment analysis activities. These tools include a sequence of events list, safety factors list, risk analysis form and evidence tables.”

WEB SITES

All Clear? <www.allclear.aero>

“all Clear? is part of the Air Ground Com-munication (AGC) Safety Improvement Initiative launched by the Eurocontrol

Safety Team in 2004,” the Web site says. “It builds on the recommendations and best practices pre-sented in the AGC European Action Plan.”

Communication problems are the most common cause of runway incursions and level busts — violations of altitude assignment — in Europe, according to the Web site. In response, Eurocontrol created a training tool kit for pilots, air traffic controllers and trainers to enhance radio communica-tions skills.


InfOscan

The tool kit is the All Clear? Web site, com-prising online training programs, download-able documents and videos. All are free.

A 30-minute training module, consisting of a video with interactive exercises for controllers and pilots, addresses communications issues, risks of communication breakdown and possible solutions.

Videos about call sign confusion, blocked transmissions, radio discipline and loss of com-munication are accompanied by transcripts and self-study notes/reviews.

Some of the online documents are “European Action Plan for Air Ground Communications Safety”; “R/T [radiotelephony] Phraseology Man-ual,” an ICAO standard phraseology reference guide for commercial air transport pilots operat-ing in European airspace; and quick tips in the form of pocket guides for pilots and controllers.

A special section is devoted to helping airline and air traffic system trainers prepare and conduct training sessions using online resources, such as videos, handouts, presentations and other materials.

Flight Safety Foundation and four other industry organizations are listed as supporters of this AGC initiative.

“Hold Short for Runway Safety,” <www.alpa.org/Default.aspx?tabid=3064>

the Air Line Pilots’ Association, Interna-tional (ALPA) says, “Through our new campaign, ‘Hold Short for Runway Safety,’

ALPA will focus its efforts on preventing run-way incursions, excursions and confusion. We will provide you commonsense guidance that will help prevent operational breakdowns.”

This runway safety Web site is not restricted to members. Posted materials, available free for on-line viewing, printing and downloading, include:

• Online Runway Safety Education Program — an interactive program “to help pilots avoid and prevent runway incursions by studying the various factors involved.” The program uses graphics, sound and anima-tion and takes 30–45 minutes to complete;

• Runway Incursions: A Call for Action — an ALPA White Paper (March 2007)

containing statistics, tables, figures, ap-pendixes and recommended readings;

• Reducing Pilot Deviations — a collection of educational FAA resources providing re-creations of air traffic control situations with embedded files of handouts, worksheets, pre-sentations, fact sheets and other documents;

• FAA Situational Awareness Through Airfield Signs & Air Traffic Control Instructions — an animated, interactive quiz to help pilots assess their knowledge of airfield markings, signs and air traffic control instructions and maintain situational awareness while taxiing;

• Three runway incursion videos; and,

• Full text of ALPA’s monthly “Runway Risks” newsletter. ●

Sources

* E-mail: Americas: <[email protected]>; Asia: <[email protected]> or <[email protected]>; Europe: <[email protected]>.

** The Stationery Office (TSO) P.O. Box 29 Norwich NR3 1GN United Kingdom Internet: <www.tso.co.uk/bookshop>

*** National Technical Information Service 5385 Port Royal Road Springfield, VA 22161 USA Internet: <www.ntis.gov>

**** Australian Transport Safety Bureau P.O. Box 967 Civic Square ACT 2608 Australia Internet: <www.atsb.gov.au>

— Rick Darby and Patricia Setze


onRECORD

The following information provides an aware-ness of problems in the hope that they can be avoided in the future. The information is based on final reports by official investigative authori-ties on aircraft accidents and incidents.

JETS

High Closure Rate Limited See-and-Avoidraytheon hawker XP, schleicher asW27. substantial damage. three minor injuries.

the Hawker was descending to land at Reno, Nevada, U.S., and the Schleicher was in a climbing turn when they collided at about

16,000 ft on Aug. 28, 2006. Both Hawker pilots and the glider pilot received minor injuries; the three passengers aboard the jet were not injured. The Hawker crew landed at Carson City Airport, which is about 25 nm (46 km) south of the Reno airport. The glider pilot bailed out and parachuted to the ground.

The collision occurred in daytime visual meteorological conditions (VMC) about 42 nm (78 km) south-southeast of Reno, “an area that is frequently traversed by air carrier and other tur-bojet airplanes inbound to RNO [Reno/Tahoe International Airport] and that is also popular for glider operations because of the thermal and mountain-wave gliding opportunities there,” said the report by the U.S. National Transporta-tion Safety Board (NTSB).

NTSB said that the probable causes of the collision were “the failure of the glider pilot to utilize his transponder and the high closure rate of the two aircraft, which limited each pilot’s

opportunity to see and avoid the other aircraft.” The report also said that the “slim design of the glider would have made it difficult for the Hawker crew to see it.” Both pilots were looking out the windshield, but the first officer did not see the glider, and the captain saw it about one second before the collision.

The glider’s right wing penetrated the Hawk-er’s nose and instrument panel, and debris caused the right engine to flame out. The landing gear did not extend normally, and the crew conducted a gear-up landing at Carson City. The glider entered a flat spin after the collision. After bailing out, the pilot said that he saw the glider spiral to the ground with the left wing and inboard section of the right wing still attached. The minor injuries to the glider pilot occurred when he was dragged over the ground by the parachute.

Because the glider’s transponder was not operating, the glider was not detected by the traffic-alert and collision avoidance system (TCAS) aboard the Hawker. “Had the glider pilot turned on his transponder, the Hawker’s TCAS-II likely would have depicted the glider on the flight crew’s monitor and would have generated an RA [resolution advisory] to alert the crewmembers and prompt them to deviate their course in time to prevent the accident,” the report said.

U.S. Federal Aviation Regulations do not require gliders — and other aircraft with-out engine-driven electrical systems — to be equipped with transponders if they are not flown in specific types of controlled airspace. However, the regulations require pilots to use transponders in aircraft that are equipped with them.

silent squawkerFailure to use transponder cited in collision of glider and jet.

BY MARK LACAGNINA


onRECORD

“According to Reno Terminal Radar Ap-proach Control personnel, it is not uncommon for arriving and departing air traffic to receive TCAS RAs because of transponder-equipped gliders operating in the area,” the report said. “In a 30-day interval before the accident, the facility recorded four such TCAS RA events reported by pilots.”

If the Schleicher’s transponder had been operating, it also would have provided air traf-fic controllers with the glider’s position and altitude, allowing them to ensure separation between the aircraft, the report said. The glider pilot told investigators that he did not turn on the transponder because he wanted to reserve battery power for radio use.

Based on the findings of the investigation, NTSB in March 2008 recommended that the U.S. Federal Aviation Administration (FAA) remove the exemption of gliders from the regulations requiring transponder installation and establish a discrete transponder code for glider operations.

NTSB told the FAA that the U.S. Aviation Safety Reporting System (ASRS) database includes 60 reports of near-midair collisions between cor-porate or air carrier jets and gliders from 1988 to August 2007. “Most of the ASRS reports involved gliders that were neither detected by the jet flight crews’ TCAS equipment nor visible on the ATC [air traffic control] facilities’ radar screens, indicat-ing that the gliders were not equipped with, or not using, a transponder,” the board said.

Spilled Coffee Causes Short CircuitBoeing 737-300. no damage. no injuries.

the aircraft was climbing through 20,000 ft during a scheduled flight from Wellington, New Zealand, to Auckland the night of May

3, 2007, when the flight crew observed several warning lights. “The warning lights included panels such as engine overheat, engine and wing anti-ice, dual hydraulic system failure, pressur-ization altitude, window overheat and auxiliary power unit,” said the report by the New Zealand Transport Accident Investigation Commission.

The crew stopped the climb and advised ATC of the situation. Checks of the flight controls,

instruments and circuit breakers indicated that an electrical malfunction was causing spurious warnings. “The captain consulted the quick refer-ence handbook [QRH] but found that it provided no help because of the number of different lights, so he contacted the operator’s maintenance watch for advice,” the report said. “The maintenance watch personnel provided no solution but men-tioned that the problem could be linked to a fluid spill in the cockpit that afternoon.”

While discussing whether they should return to Wellington, continue to Auckland or divert to a nearby airport, the pilots detected the odor of burning electrical insulation. They donned smoke goggles and oxygen masks, declared an urgency and diverted to Royal New Zealand Air Force Base Ohakea. After extending the landing gear, the crew saw three green lights, indicating that the gear was down and locked; however, a subsequent check on short final approach showed that the gear lights were not illuminated.

The crew conducted a go-around and the manual gear-extension procedure. The gear lights did not illuminate, but the airport traffic controller advised that the gear appeared to be down. Based on this advisory and other cues — including the sound and feel of the aircraft, and the thrust required to maintain airspeed — the crew decided that the gear was extended and the gear lights were faulty. The captain elected not to use the viewing ports to check the gear. “The captain knew that the time involved would delay the aircraft landing, and with a potential electrical fire, landing as soon as possible was a priority,” the report said.

The crew landed the 737 without further incident and taxied to the apron, where the 121 passengers disembarked on airstairs.

The report said that while another crew was preparing the aircraft for an earlier flight from Wellington, the first officer spilled coffee on the center control pedestal. The pilots used paper towels to mop the spilled coffee and called a maintenance engineer to the cockpit. The engi-neer replaced the audio selector panel but found no sign that the spilled coffee had affected other equipment in the pedestal. “A functional check

The glider pilot told

investigators that he

did not turn on the

transponder because

he wanted to reserve

battery power for

radio use.


onRECORD

of the various modules and other electrical sys-tems showed that they were operating normally,” the report said. The engineer recorded the fluid spill in the technical log. The aircraft then was flown to Auckland and back to Wellington without incident.

Investigators found that some of the spilled coffee had leaked into the stabilizer trim and cockpit door lock module, which shares circuitry with other components in the center pedestal. “The heat generated by the lights in the module and the surrounding area slowly evaporated the water in the spilled liquid, leav-ing a sticky residue of carbonized sugar that was a better conductor than liquid coffee,” the report said. “Consequently, the electrical current flow gradually increased and generated more heat, resulting in the slow electrical breakdown and subsequent melting and burning of the light as-sembly components in the module.”

Missed turn Leads to Close Call on Runwayairbus a320, Boeing 757-200. no damage. no injuries.

daytime VMC prevailed when the 757 flight crew taxied toward Runway 09L for de-parture from Fort Lauderdale–Hollywood

(Florida, U.S.) Airport on July 11, 2007. The air-port ground traffic controller’s taxi instructions had included a turn onto a taxiway that parallels Runway 09L, the NTSB report said.

The crew missed the turn and continued taxiing toward the runway. The airport local traffic controller, who had cleared the A320 flight crew to land on Runway 09L, noticed that the 757 was nearing the runway. The local controller told the ground controller to instruct the 757 crew to stop. The ground controller radioed the 757’s call sign and said, “Stop, stop, stop.” The crew brought the 757 to a stop on the runway, 30 ft (9 m) from the centerline.

Meanwhile, the local controller told the A320 crew to go around. “When the crew received the instruction, the main landing gear was on the ground,” the report said. “They [said] they noted the urgency in the controller’s voice, so they knew they had to get the aircraft airborne.” During the go-around, the A320 passed the 757 within 100 ft

vertically and 230 ft (70 m) laterally. There were 307 people aboard the two airplanes.

Computer failure Darkens flight Displaysembraer 145eP. Minor damage. no injuries.

there was a broken ceiling at 1,000 ft when the aircraft departed from Aberdeen (Scotland) Airport with 16 passengers for

a scheduled flight to Manchester, England, on May 10, 2007. The aircraft was climbing through 11,600 ft when the autopilot disengaged and the commander’s primary flight display and multi-function display, and the engine indicating and crew alerting system display went blank, said the report by the U.K. Air Accidents Investigation Branch (AAIB). A red “X” appeared on each of the failed displays.

The flight crew said that a “smoky haze” emerged from the left side of the commander’s seat, and they detected an “acrid burning smell.” The crew declared an emergency and returned to Aberdeen. After descending below the clouds during the approach, the commander saw the runway but the copilot, the pilot flying, did not. The commander took control and landed the aircraft using the standby flight instruments.

“At no time during the incident did the crew put on their oxygen masks, instruct the cabin crew to put on their oxygen masks, deploy the passenger oxygen masks or refer to the QRH,” the report said.

The 145’s QRH has three checklists per-taining to smoke; among immediate actions common to all three checklists is to don oxygen masks and smoke goggles. The commander told investigators that he did not don his oxygen mask because there was only a small amount of smoke. The copilot said that he did not call for the appropriate checklists because he was con-centrating on flying the aircraft and was worried that his flight displays also might go blank.

The report said that these omissions could have had serious consequences. By donning their oxygen masks, “the crew would have been protected from any invisible gases that might have been present during the recovery,” the re-port said, adding that if the appropriate checklist

The commander

took control and

landed the aircraft

using the standby

flight instruments.


onRECORD

had been conducted, the commander’s failed displays would have been restored.

The aircraft operator determined that the display failures and the smoke had been caused by the failure of a capacitor in the power supply for the no. 1 integrated avionics computer.

Altitude Callouts neglected Below DHlearjet 35a. destroyed. two fatalities, three minor injuries.

the flight crew was conducting a charter flight from Atlantic City, New Jersey, U.S., to Groton, Connecticut, the afternoon of June

2, 2006. The automatic terminal information system (ATIS) indicated that Groton, a coastal airport, had 2 mi (3,200 m) visibility in mist, a 100-ft broken ceiling and surface winds from 170 degrees at 8 kt.

The crew briefed the ILS (instrument land-ing system) approach to Runway 05, which is conducted over water, and the missed approach procedure. “Two smaller airplanes had suc-cessfully completed the approach prior to the accident airplane,” the NTSB report said.

The captain flew the approach, and the first officer made 100-ft callouts until the airplane was 200 ft above decision height (DH). “At that point, the captain asked the first officer if he saw anything,” the report said. “The first officer reported ‘ground contact,’ then ‘decision height.’ The captain immediately reported, ‘I got the lights,’ which the first officer confirmed.”

Neither pilot made altitude callouts after the Learjet descended below DH. “The absence of ground references could have been conducive to a featureless terrain illusion in which the captain would have believed that the airplane was at a higher altitude than it actually was,” the report said.

The captain had reduced power to flight idle at DH. “Approximately four seconds later, the captain attempted to increase power,” the report said. “However, the engines did not have time to respond before the airplane descended into the water and impacted a series of approach light stanchions, commencing about 2,000 feet [610 m] from the runway.” Both pilots were killed; the three passengers received minor injuries and were rescued by boaters.

TURBOPROPS

‘thrown Inverted’ by turbulenceBeech c90-1 King air. substantial damage. no injuries.

the King Air was in cruise flight between cloud layers at 17,000 ft near Meridian, Mississippi, U.S., on Jan. 31, 2008, when the pilot saw cloud

buildups ahead. He requested and received clear-ance from ATC to make a slight turn and to climb to Flight Level (FL) 190 (about 19,000 ft), to avoid the largest buildup, the NTSB report said.

The pilot told investigators that no severe weather was depicted by the airplane’s weather radar system or Stormscope. However, when the airplane entered the clouds in a right, climbing turn, it almost immediately encountered severe turbulence and was “thrown inverted” in a nose-down attitude, the pilot said.

“As the airplane gained airspeed, the pilot pulled the throttles to idle and pushed the pro-peller levers full forward,” the report said. “He then rolled the airplane upright and had to pull the yoke ‘extremely hard’ to recover from the dive.” The upset occurred at 17,500 ft, and the recovery was completed at 10,500 ft. None of the four people aboard the King Air was injured.

“The pilot then climbed the airplane to FL 190 and completed the rest of the flight un-eventfully,” the report said. “On the subsequent preflight inspection, the pilot found wrinkling in wing sheet metal.”

Starter failure Causes Cowling Separationlockheed electra. Minor damage. no injuries.

after a cargo flight from Nottingham, Eng-land, to Cork, Ireland, the morning of Oct. 12, 2006, a ground crewmember observed

that two cowlings were missing from the no. 3 engine. Minor damage also was found on the Electra’s fuselage and the no. 4 engine’s propel-ler, said the AAIB report.

The pilots said that the engine-start sequence and the Electra’s handling and engine indications during the flight to Cork had been normal.

The cowlings were found on a taxiway at the Nottingham airport. The investigation revealed that while the Electra was being taxied for


onRECORD

departure, the casing on the no. 3 engine’s air turbine starter motor gearbox failed, releasing a rotating clutch assembly into the engine nacelle. The clutch assembly struck the leading edge of the left cowling, bending it outward, where it was exposed to propeller wash. “This appeared to have pressurized the interior of the engine nacelle sufficiently to have overloaded the cowl-ings’ latch structure, allowing both cowlings to be released,” the report said. “The right cowling was then struck by the no. 4 propeller.”

The report said that the failure of the air starter gearbox casing likely was caused by propagation of a crack in the casing and even-tual overload of the casing material.

Shortcut During a nighttime ApproachBeech B-99. substantial damage. one minor injury.

the cargo airplane was nearing the destination at about 0200 local time on Dec. 29, 2006, when the en route traffic controller told the

pilot that the weather conditions at Rapid City, South Dakota, U.S., included surface winds from 340 degrees at 18 kt, gusting to 25 kt, 2.5 mi (4,000 m) visibility and a broken ceiling at 1,300 ft. The altimeter setting was 30.31 in Hg.

The controller cleared the pilot to conduct the ILS approach to Runway 32 and to cross the initial approach fix (IAF) — the locator outer marker, 4.6 nm (8.5 km) from the runway — no lower than 6,000 ft, the NTSB report said. The airport traffic control tower was closed, and ATC radar service was not available for the approach.

Instead of flying to the IAF and conduct-ing the published procedure turn, the pilot flew the DME (distance measuring equipment) arc for the published VOR (VHF omnidirectional radio) approach to Runway 32 at 4,700 ft to intercept the ILS localizer. “He stated that after turning inbound on the final approach course, he performed the ‘Before Landing’ checklist, set the gear and flaps, and reported inbound on the common traffic advisory frequency,” the report said. “He stated that less than five minutes later, he felt a sharp blow, added full power and pitched the nose up, but the recovery attempt was unsuccessful.”

The B-99 struck terrain about 7 nm (13 km) from the airport, at 3,200 ft. Airport elevation is 3,204 ft. NTSB said that the probable cause of the accident was “the pilot’s failure to follow the published instrument approach procedure, which contributed to his failure to maintain altitude and clearance from terrain.”

The report noted that the pilot’s altimeter was set to 30.44 in Hg and that tests showed it read 360 ft high. “No determination was made as to whether the discrepancy existed prior to impact,” the report said. “However, the pilot did not report any preflight discrepancies with regard to the airplane’s altimeters.”

nosegear Collapses During towBritish aerospace Jetstream 41. substantial damage. no injuries.

the ground crewmembers were not wearing headsets and were using hand signals to com-municate with the commander during push-

back from the stand at Birmingham (England) Airport on June 26, 2007. The aircraft was towed onto a taxiway, the parking brake was set, and the nosewheel was chocked. However, the ground crew was unable to disconnect the towbar.

“The aircraft was now blocking the taxiway and obstructing another aircraft that was wait-ing to taxi,” the AAIB report said. “The flight crew obtained ATC permission to return to the stand. The commander used hand signals in an attempt to communicate his intentions to the [ground] crew.”

The commander pointed at the aircraft waiting to taxi, at himself and then in the direction of the stand. When a ground crew-member pointed at the stand, the commander gave him a thumbs-up signal to confirm his intention to return to the stand. However, the ground crew apparently understood the commander’s thumbs-up signal to mean that the Jetstream’s brakes were off and that he was ready to return to the stand. The commander had not released the parking brake. “Without any further signals, the tug commenced revers-ing, and the nosegear collapsed,” the report said, noting that the propellers came close to striking the ground.

The ground

crew apparently

understood the

commander’s

thumbs-up signal

to mean that the

Jetstream’s brakes

were off.


onRECORD

The driver of the tow vehicle told inves-tigators that the ground crew was not using headsets because they were unserviceable. Both the airport and the operator require voice com-munication between the ground crewmember-in-charge and the aircraft commander during towing operations. “Despite these require-ments, it was not unusual for a pushback to be conducted using hand signals only,” the report said. “However, following this accident, ground-handling staff have been instructed to use a headset at all times.”

PISTON AIRPLANES

Commuter flight Runs Out of fuelPiper chieftain. substantial damage. no injuries.

VMC prevailed for the 85-nm (157-km) commuter flight from Aniak to Kalskag and Bethel in southwestern Alaska, U.S.,

the morning of June 13, 2007. The pilot estimat-ed that the airplane had 1.2 hours of fuel for the 30-minute flight, the NTSB report said.

The Chieftain was en route from Kalskag to Bethel when the left engine fuel pressure warn-ing light illuminated. The light went out when the pilot engaged the emergency fuel pump and switched fuel tanks. “A few minutes later, the right engine fuel pressure light illuminated,” the report said. “He turned on the emergency pump and switched tanks, but the light did not extinguish. When the right engine began to surge, he shut the engine down and feathered the propeller.”

The pilot diverted the flight toward the nearest airport, in Tuluksak. “On short final, the left engine began to surge, and he put the gear extension handle in the ‘DOWN’ position, but the gear failed to fully extend and lock prior to touchdown,” the report said. “The airplane sustained damage to the gear-attachment points and wings when the landing gear collapsed during landing.” The pilot and eight passengers were not injured.

The report said that about 8 oz (237 mL) of fuel were drained from each of the main tanks, 1.0 gallon (3.8 L) from the right main tank and

2.0 gallons (7.6 L) from the left main tank. The Chieftain’s usable fuel capacity is 182 gallons (681 L).

Pilot Incapacitated During training flightBeech 58 Baron. no damage. no injuries.

the 22-year-old flight instructor was practic-ing instrument procedures at Brusselton, Western Australia, on Feb. 13, 2007. “A

second pilot was on board to act as a safety pilot and to look out for other aircraft,” said the re-port by the Australian Transport Safety Bureau.

While conducting an NDB (nondirectional beacon) approach in VMC, the pilot became incapacitated. The safety pilot assumed control and landed the Baron. “The incapacitated pilot received treatment from attending ambulance officers,” the report said. “Following a check by a designated aviation medical examiner and four days rest, the pilot was approved to return to work.”

Medical testing had disclosed no health problems, and the incident was suspected to have been caused by inadequate nourishment. The pilot told investigators that he had experi-enced a similar event 12 months earlier that was attributed to dehydration.

After the Feb. 13 incident, the Australian Civil Aviation Safety Authority (CASA) sus-pended the pilot’s medical certificate and re-quested that he undergo further medical testing. “The testing found that the pilot had epilepsy, and CASA revoked the pilot’s medical [certifi-cate],” the report said.

fatigue Cited in Control Losscessna t303. destroyed. five fatalities.

the pilot departed from Atlantic, Iowa, U.S., at 0502 local time Nov. 13, 2006, picked up three company employees in Ankeny, Iowa,

and flew them to South Bend, Indiana. The pilot stayed at the airport while the passengers attended a business meeting. A fourth passenger was aboard for the return flight, which began at 1953. The NTSB report said that a ground-service person noted that the pilot “looked tired, or just ready to go home.”


onRECORD

After departing from South Bend, the pilot prematurely attempted to establish radio com-munication with air traffic departure control on the airport tower frequency and flew a heading of 270 degrees rather than the assigned heading of 220 degrees. “The pilot corrected the head-ing, and shortly thereafter the airplane once again began a right turn back toward the west,” the report said. “[ATC] radar data showed the airplane then began another left turn, during which time it entered a spiraling rapid descent. According to weather data, the airplane was in instrument meteorological conditions when this occurred.”

The airplane struck terrain about 8 nm (15 km) west-southwest of the airport at 2003. NTSB said that the accident occurred because “the pilot became spatially disoriented and, as a result, failed to maintain control of the airplane” and that contributing factors were the weather conditions and pilot fatigue.

HELICOPTERS

Power Loss noticed too Late on takeoffPZl-swidnik Mi-2. substantial damage. one fatality, five minor injuries.

the helicopter was hired to pick up five people in a paved area near a nursing home in Heby, Sweden, and fly them to Ljusterö

as part of a celebration of a passenger‘s 100th birthday on June 21, 2005. The pilot checked the site from the air and decided it was suitable for a landing, said the report by the Swedish Accident Investigation Board.

After boarding the passengers, the pilot restarted the two turboshaft engines, “checked that the power output and the rotor speed were normal, hovered vertically, reversed and began a climb,” the report said. The helicopter was about 3 m (10 ft) above the ground when one engine lost power. The report said that the pilot did not detect the power loss soon enough to safely reject the takeoff.

“Because of the possible risk to the specta-tors who had assembled near the takeoff site, the pilot decided that it was dangerous to them to

land immediately and continued the flight at the altitude reached, veering slightly to the right,” the report said.

The main rotor struck tree branches and a street-light pole, and the helicopter descended to the ground and rolled over. A post-impact fire was extinguished by one of the passengers and some bystanders while the pilot assisted the other passengers in evacuating the aircraft. The 100-year-old passenger had received serious injuries and died three days later.

Examination of the engine revealed that corrosion had caused partial blockage of the fuel-injection nozzle; the resulting decrease in fuel flow reduced the engine’s power output by half.

Passenger Walks Into tail RotorBell 206l-1. no damage. one serious injury.

the helicopter departed from Houma, Loui-siana, U.S., the morning of June 6, 2006, to pick up three passengers on a platform in

the Gulf of Mexico. The pilot had briefed and flown the passengers before. The purpose of the flights was to conduct checks of the company’s offshore platforms.

After boarding the passengers, the pilot asked if they had any questions about aircraft safety. “The passengers indicated that they had no questions regarding safety or emergency equipment,” the NTSB report said.

The pilot flew the LongRanger to another platform and landed in the middle of the 40- by 40-ft (12- by 12-m) helideck. He kept the engine running as two of the passengers disembarked and walked to a stairway in front of the helicop-ter. About five minutes later, one of the passen-gers emerged from the stairway in front of the helicopter and saw the other passenger emerge from the other stairway, behind the helicopter. He yelled a warning, but the other passenger walked into the tail rotor.

NTSB said that the probable causes of the accident were “the passenger’s failure to follow procedures associated with operations in the vicinity of the helicopter and his failure to see/avoid the tail rotor.” ●


onRECORD

Preliminary Reports

Date Location Aircraft Type Aircraft Damage Injuries

April 3, 2008 Benzdorp, Suriname Antonov An-28 destroyed 19 fatal

On approach to Lawa-Atino Airport, the flight crew was told that another aircraft was on the runway. The crew was conducting a go-around when the An-28 struck a hill.

April 3, 2008 Mwanza, Tanzania Reims F-406 destroyed 2 fatal

The twin-turboprop airplane struck a hill while departing on a training flight.

April 9, 2008 Bundeena, Australia Swearingen Metro III destroyed 1 fatal

The airplane crashed in the sea soon after the pilot reported a technical problem while departing from Sydney on a cargo flight.

April 9, 2008 Nazca, Peru Cessna U206C destroyed 5 fatal, 1 minor

The pilot was attempting to return to the airport after losing power during departure for a sightseeing flight when the single-engine airplane struck power lines and crashed.

April 9, 2008 Unalaska, Alaska, U.S. Grumman G-21A Goose substantial 1 serious, 8 minor

The commuter airplane crashed on the runway after the landing gear struck the top of a truck that was being driven on a road near the approach end of the runway.

April 11, 2008 Chisinau, Moldova Antonov An-32B destroyed 8 fatal

Following maintenance, the Sudanese aircraft was departing at nighttime when an on-board equipment malfunction occurred. The crew was attempting to return to the airport when the An-32 struck navigation equipment and exploded on final approach.

April 11, 2008 Taylor, Texas, U.S. Beech King Air 200 minor 1 fatal

The pilot heard a high-pitched sound during a post-maintenance test flight and returned to the airport. The engines were at idle power, and the cabin was partially pressurized when a maintenance technician attempted to board the King Air. The cabin door blew open and struck the technician.

April 15, 2008 Goma, Democratic Republic of Congo Douglas DC-9-51 destroyed 40 fatal, 111 serious

The crew rejected the takeoff after an engine lost power. The DC-9 overran the runway and crashed and burned in a residential area. Three of the 86 passengers and 37 people on the ground were killed; 40 passengers and 71 people on the ground were seriously injured.

April 15, 2008 Chickaloon, Alaska, U.S. Eurocopter AS 350B2 substantial 4 fatal, 1 serious

There were both visual and instrument meteorological conditions in the area when the helicopter struck steep snow-covered terrain during a visual flight rules air-taxi flight.

April 16, 2008 Annobon Island, Equatorial Guinea Antonov An-32 destroyed 11 fatal

The aircraft overran the runway while landing in strong wind and heavy rain.

April 19, 2008 Mount Vernon, Missouri, U.S. Cessna P206 destroyed 2 fatal, 2 serious, 3 none

The airplane stalled while being turned toward the drop zone. Four parachutists jumped before the Cessna spun to the ground; one was injured while exiting the airplane. Another parachutist was killed when her reserve parachute deployed and became entangled with the empennage. The sixth parachutist was killed when the airplane struck terrain. The pilot was seriously injured.

April 21, 2008 Coari, Brazil Embraer Bandeirante destroyed 14 none

The crew diverted to Coari after an engine problem occurred during a scheduled flight from Manaus to Caraurari. The Bandeirante slid off the runway during the landing.

April 28, 2008 Black Sea Mil Mi-8T destroyed 20 fatal

The helicopter crashed in the sea after the tail rotor struck a tower during approach to a platform 70 km (38 nm) southwest of Cape Tarhankut, Crimea, Ukraine.

April 28, 2008 Catia La Mar, Venezuela Piper Navajo destroyed 3 fatal

The Navajo crashed into a building after the pilot reported an engine problem during approach.

April 29, 2008 Shannon, Ireland ATR 72 none 30 none

An engine problem occurred during a flight from Dublin to Galway. The crew shut down the engine, diverted to Shannon Airport and landed without further incident.

This information, gathered from various government and media sources, is subject to change as the investigations of the accidents and incidents are completed.

W O R L DAeroSafety

Let us give you the world.

AeroSafety World is flight Safety foundation’s monthly magazine that keeps pace with the most important safety issues and developments in aviation.

until recently, only fSf members could receive it. now anyone can … free.

AeroSafety World is available for downloading via a link from the fSf Web site. We’ve been amazed at the number of downloads the online version has received. We’re delighted at the interest that readers have shown.

So we’re doing still more to accommodate you.

no longer do you need to remember to check the Web site each month. you can literally subscribe to the online AeroSafety World. Just fill out a brief subscription form and every month you will receive an e-mail

with a link to the latest issue — which appears even before many people get their printed copy.

AeroSafety World. The information is solid, thoroughly researched by a knowledgeable editorial staff and industry aviation safety experts. The design is dazzling.

you can talk back to us via letters to the editor. What are you waiting for?

go to <www.flightsafety.org> for the subscription form. and tell your friends. for larger groups, the foundation can also supply an e-mail message for you to let your colleagues in on the deal.

Write to Jay donoghue, <[email protected]>, or call him at +1 703.739.6700.

After all, it isn’t every day you get a FREE offer for the world.

Using actual performance data to improve safety by identifying:

• Ineffectiveorimpropertraining;

• InadequateSOPs;

• Inappropriatepublishedprocedures;

• Trendsinapproachandlandingoperations;

• Non-compliancewithordivergencefromSOPs;

• Appropriateuseof stabilized-approachprocedures;and

• Risksnotpreviouslyrecognized.

Likely reduces maintenance and repair costs.

Accomplishes a critical Safety Management System step and assists in achieving IS-BAO compliance.

For more information, contact:

Jim Burin DirectorofTechnicalProgramsE-mail:[email protected]:+1703.739.6700,ext.106

C-FOQACorporate Flight Operational Quality Assurance

A cost-effective way to measure and improve training, procedures and safety

Documents

AeroSafety World, June 2008 · if you have an article proposal, manuscript or technical paper that you believe would make a useful contribution to the ongoing dialogue about aviation